Careers

Diversity

With 17 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

James Sherer Comments on Client Questions Post-Election in Law.com and The Recorder Articles

Peter Roskam and BakerHostetler’s Post-Election Webinar Mentioned in Articles on Trump’s Second Administration

Michael Snarr Comments on Tariffs and Trade Under New Administration

Sarah La Voi, Lauren Bass Pen Article for The Licensing Journal on Morals Clause

<figure class="wp-block-image alignright size-large is-resized"><img decoding="async" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2022/09/DADM_GettyImages-1088260228_1200x630-1-662x348.jpg" alt="" class="wp-image-7157" width="428"/></figure>



After a long stretch of breach enforcement actions and settlements arising out of alleged technology gaps, the U.S. Department of Health & Human Services Office for Civil Rights (OCR) announced that it settled a case that involved improper disposal of physical protected health information (PHI). This case unusual for its quick resolution, but that is likely a byproduct of the fact that it would be hard to defend, given OCR’s well-settled advice on this issue. This case serves as a reminder to covered entities that, while electronic medical records and security rule violations are more the norm, they must still recognize paper records as a possible source of a breach.



Just over a year after New England Dermatology P.C., d/b/a New England Dermatology and Laser Center (NEDLC), reported a breach, OCR <a href="https://www.hhs.gov/about/news/2022/08/23/ocr-settles-case-concerning-improper-disposal-protected-health-information.html">announced</a> on August 23, 2022, that it settled with NEDLC. On May 11, 2021, NEDLC filed a breach report with OCR stating that it improperly disposed of empty specimen containers, the labels for which contained PHI. NEDLC placed the containers in a dumpster in its parking lot. The containers’ labels included patient names and dates of birth, dates of sample collection, and the name of the provider who took the specimen. The issue came to light on March 31, 2021, when a third-party security guard found one of the specimen containers in the parking lot, outside of the dumpster. NEDLC stated that it disposed of specimen containers in this way, without removal of PHI, from February 4, 2011, until March 31, 2021. The OCR’s database of archived reported breaches indicates that NEDLC identified 58,106 patients impacted by this issue.



The <a href="https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/nedlc-ra-cap/index.html">Resolution Agreement and the Corrective Action Plan (CAP)</a>, state that OCR’s investigation identified two potential violations: 1) failure to “maintain appropriate safeguards to protect the privacy of PHI, as required by the Privacy Rule (see 45 C.F.R. § 164.530(c)),” and 2) impermissible disclosure of “PHI to unauthorized individuals in violation of the Privacy Rule (see 45 C.F.R. § 164.502(a)).” Neither the Resolution Agreement nor the CAP discussed how the “Resolution Amount” of $300,640 was calculated.



The CAP obligates NEDLC to develop, maintain and appropriately revise written policies and procedures in accordance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule (45 C.F.R. Part 160 and Subparts A and E of Part 164), including designation of a privacy official to implement those policies and procedures, and provide them to OCR for review and approval. The CAP stated that the Privacy Rule policies and procedures must contain, at a minimum:



<ul>
<li>A policy for the disposal of all PHI created, received or maintained by the covered entity.</li>



<li>Protocols for training all workforce members who are involved in handling and disposing of PHI as necessary and appropriate to ensure compliance with the policies and procedures.</li>



<li>Procedures to review and update as necessary the covered entity’s policy for the physical safeguarding of PHI.</li>



<li>Protocols for training all workforce members who are involved with handling PHI to ensure compliance with the policies and procedures.</li>



<li>Application of appropriate sanctions against workforce members who fail to comply with policies and procedures for safeguarding and disposal of PHI.</li>
</ul>



The CAP also requires NEDLC to provide OCR with its training materials for review and approval and obtain electronic certification from workforce members once training is completed annually and at the time of onboarding. As is customary, NEDLC is required to file annual reports of compliance as well as reports of any workforce member’s or business associate’s violation of its policies and procedures.



Improper disposal is not unique to NEDLC. OCR’s database of reported breaches impacting over 500 patients indicates that since 2010, 115 such breach reports have been filed with the type of breach identified as “improper disposal.” Seven of those incidents, which were reported between December 2020 and June 2022, are still under investigation. This Resolution Agreement signals that covered entities and business associates cannot lose sight of physical safeguards of PHI, even as ransomware and other technology intrusions continue to dominate the news cycle.



<a id="_msocom_1"></a>

core/freeform

Data Counsel

Chicago

Partner

Aleksandra Vold

Digital Assets and Data Management

What’s Old Is New Again: OCR Announces $300,000 Settlement Related to Improper Disposal of Physical PHI

Related Services

Featured Insights