Dropped-off boxes cost system $800,000 in HIPAA settlement
In what may be one of the most expensive home deliveries in healthcare regulatory history, employees of Fort Wayne, Ind.-based Parkview Health System dropped off 71 cardboard boxes of patient medical records in the driveway of a physician’s home, and now the organization is paying hundreds of thousands of dollars in penalties as a result.
Left “unattended and accessible to unauthorized persons,” the records were “within 20 feet of the public road and a short distance away from a heavily trafficked public shopping venue,” according to a news release from HHS’ Office for Civil Rights. As a result, Parkview has agreed to pay $800,000 to settle potential violations of the privacy rule of the Health Insurance Portability and Accountability Act, and will adopt a corrective action plan, according to the OCR.
The office began its investigation following a complaint from a retiring physician. In September 2008, Parkview obtained the medical records of between 5,000 and 8,000 patients of a retiring physician as the system sought to buy a portion of the physician’s practice and transition patients to other providers. The records were dropped off on June 9, 2009, by Parkview employees “with notice that the physician was not at home.”