Unsafe handling: PHI disposed in the garbage leads to OCR resolution

Why This Topic Matters

Improper disposal of PHI can lead to enforcement action, corrective action plans, and ongoing monitoring. The article helps readers understand why disposal practices, written policies, workforce training, and privacy governance matter for HIPAA compliance.

Article Sections

1. Behind the breach

   Summarizes the reported incident and the broad categories of privacy concerns identified in the OCR investigation. It also outlines the types of corrective measures included in the resolution agreement.

2. Another ‘disheartening’ finding

   Provides expert commentary on the incident and discusses the compliance shortcomings highlighted by the resolution. It also addresses how small and moderate-sized practices may struggle with privacy program implementation.

3. Is it a small entity problem?

   Explores whether resource constraints contribute to privacy and security gaps in smaller covered entities. The section discusses the importance of assigning privacy responsibility and maintaining attention to HIPAA obligations.

4. Policy and procedure woes

   Focuses on the need for written privacy and security policies and procedures, including structured documentation for smaller offices. It also addresses how safeguards should be tailored to the organization’s risks.

5. Beef up workforce training

   Discusses workforce training expectations and the role of documented procedures in shaping training content. The section emphasizes ongoing training needs for staff and relevant personnel.

6. Lack of security means increased risk

   Describes disposal-related security risks and the compliance concerns raised by the handling of physical PHI. It includes general risk assessment and audit themes raised by the experts quoted in the article.

7. Action steps for compliance

   Lists broad categories of controls and operational practices organizations may consider for protecting PHI during disposal. It also references different types of disposal methods and oversight of vendors and processes.