Largest Ever Settlement for Patient Privacy Violation Under HIPAA

Another Settlement Expected Soon

Failure to securely dispose of items containing protected patient information cost two of the nation’s three largest retail pharmacy chains a total of $2.25 Million and $1 Million to settle alleged violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule, the U.S. Department of Health and Human Services (HHS) announced on Tuesday, July 27.

WTHR TV, an Indianapolis television station, found retail pharmacies in a dozen cities improperly disposing of various items containing protected patient information, in 2006, prompting a two year coordinated investigation by the U.S. Department of Health and Human Services (HHS) and the Federal Trade Commission (FTC). The announcement of a $1 million settlement with RiteAid is the second such settlement resulting from the WTHR’s reports. A $2.25 million settlement agreement was already announced last year between HHS and CVS pharmacies. Federal regulators are expected to soon announce the results of a similar investigation of possible violations by several Walgreens locations, which were also reported by WTHR.

WTHR’s “Prescription Privacy” investigation spanned six months of work and showed that many CVS, Walgreens and RiteAid pharmacies were disposing of prescription labels, patient information sheets, pill bottles, prescription forms and customer refill lists in dumpsters in and around Boston, Chicago, Cleveland, Dallas, Denver, Detroit, Louisville, Miami, New Haven (Conn.), Philadelphia, and Phoenix.

Walgreens operates more than 8,000 drug stores nationwide, CVS has more than 7,000 pharmacies, and Rite Aid operates approximately 4,800. Since the Walgreens chain has more stores, that may explain why that investigation is taking longer than the other two. On the other hand, it may be that the settlement with Walgreens could be the largest of the three, and is being saved for last.

WTHR now maintains an entire web page dedicated to this Prescription Privacy Investigation:

See the Main Page HERE

See the Video Report by WTHR HERE

The HHS Resolution Agreement and Corrective Action Plan can be found on the OCR website at http://www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/index.html.

OCR has FAQs that address the HIPAA Privacy Rule requirements for disposal of protected health information. They can be found on the OCR website at http://www.hhs.gov/ocr/privacy/index.html.

Information about the FTC Consent Order agreement is available at http://www.ftc.gov.

Note: All HHS press releases, fact sheets and other press materials are available at http://www.hhs.gov/news.