Precipitating Event: Local TV news reported that pharmacy was dumping pill bottles in open dumpster.
(a) On several occasions between July 2006 and May 2007, some XYZ retail pharmacies disposed of PHI in open dumpsters potentially accessible to persons who were not authorized members of the XYZ Pharmacies' workforce.
(b) The policies and procedures establishing physical and administrative safeguards that the XYZ Pharmacies adopted and implemented from April 2003 until November 2006 for their disposal of PHI were not adequately designed to appropriately and reasonably safeguard PHI.
(c) The XYZ Pharmacies did not maintain a sanctions policy for members of their workforces who failed to comply with the policies and procedures.
(d) From April 2003 through November 2006, while the XYZ Pharmacies provided and documented their provision of training, the training and/or documentation of the provision of necessary and appropriate training for the members of their workforces regarding the disposal of PHI was not sufficient to ensure that appropriate workforce members knew how to dispose of PHI consistent with the Privacy Rule.
minor modifications for readibility
"disposed of PHI in open dumpsters"
Understand the lifecycle of all of your PHI. PHI is created, maintained, then destroyed.
Ask Yourself: How are your PHI disposal policies and procedures?
"did not maintain a sanctions policy"
If a policy is not enforced, it is not a policy. If a policy is not applied to everybody (e.g. management) then it breeds resentment.
Ask Yourself: Who enforces your policies?
"was not sufficient to ensure"
This pharmacy chain did all of the recommended HIPAA actions, but, in the opinion of the HIPAA police, they did not do enough. The message is do not just go through the motions. Take a conservative approach that avoids any gray areas.
Ask Yourself: Are you giving lip service to some policies and procedures?
A year later, another large pharmacy chain had this exact same pill bottles in open dumpster breach of PHI, though the fine was $1,000,000. The details are nearly identical so, to save time, a separate case study was not written up.