Compliance: Practice pays a high price for putting PHI in the garbage

Why This Topic Matters

Improper disposal of patient information can trigger enforcement action, financial penalties, and corrective action requirements. The article is relevant to practices that handle paper, specimen containers, labels, prescription packaging, and other physical PHI, especially smaller organizations building or strengthening HIPAA compliance programs.

Article Sections

1. Behind the breach

   Summarizes the reported incident, the type of information involved, and the enforcement response from OCR. It also outlines the general compliance areas implicated by the investigation.

2. Another ‘disheartening’ finding

   Presents expert commentary on the nature of the lapse and the broader implications for privacy oversight in smaller practices.

3. Is it a small entity problem?

   Discusses compliance challenges that smaller provider organizations may face and the importance of assigning responsibility for privacy functions.

4. Policy and procedure woes

   Reviews the role of written privacy and security policies, along with the need for practical procedures tailored to office-specific risks.

5. Beef up workforce training

   Covers workforce education, documentation, and the need for routine training tied to organizational procedures.

6. Lack of security means increased risk

   Explains broader disposal-related privacy and security risks and the importance of assessing and monitoring disposal practices.

7. Action steps for compliance

   Outlines general categories of safeguards, oversight activities, and disposal methods that organizations may consider when building compliance programs.