An $800,000 settlement between the Department of Health and Human Services Office of Civil Rights (OCR) and Parkview Health System, Inc., serves as a reminder that all providers are subject to HIPAA penalties--regardless of their size, location or corporate status.
Parkview Health System, a nonprofit healthcare system providing community-based services in Indiana and Ohio, learned a tough lesson about the right and wrong ways to dispose of patient records.
After a physician retired, Parkview took control over medical records for more than 5,000 of the physician's patients. One day, Parkview employees left 71 boxes of patient records in the physician's home driveway while he was not home. The physician found the records and complained to the OCR, which investigated Parkview's HIPAA Privacy policies, procedures, and training practices.
You are only as compliant as your employees
To compliance officers and privacy officers, it is likely obvious that dumping patient files in a doctor's driveway is a big mistake. But are you confident that your employees know this is wrong? Compliance officers and privacy officers can't control all aspects of a nursing home. Instead, they must rely on the policies, procedures and training they have established to guide employees. If your employees need a refresher on the proper way to dispose of patient records, the OCR has put one together here. With HIPAA audits around the corner, and record-breaking HIPAA enforcements, now is a good time to make sure your employees know what to do.