What’s Old Is New Again: OCR Announces $300,000 Settlement Related to Improper Disposal of Physical PHI

After a long stretch of breach enforcement actions and settlements arising out of alleged technology gaps, the U.S. Department of Health & Human Services Office for Civil Rights (OCR) announced that it settled a case that involved improper disposal of physical protected health information (PHI). This case unusual for its quick resolution, but that is likely a byproduct of the fact that it would be hard to defend, given OCR’s well-settled advice on this issue. This case serves as a reminder to covered entities that, while electronic medical records and security rule violations are more the norm, they must still recognize paper records as a possible source of a breach.

Just over a year after New England Dermatology P.C., d/b/a New England Dermatology and Laser Center (NEDLC), reported a breach, OCR announced on August 23, 2022, that it settled with NEDLC. On May 11, 2021, NEDLC filed a breach report with OCR stating that it improperly disposed of empty specimen containers, the labels for which

Read more

Explore the site

More from the blog

Latest News