Some physical files of medical records from Women’s Health Consultants in South Whitehall Township and Hanover Township, PA were dumped in a recycling center in Allentown, Pennsylvania. The files contained names, medical histories of cancer and HIV patients and Social Security numbers. Women’s Health Consultants is no longer open for business. So, there’s probably no way of knowing how the files got dumped at the recycling center considering there were no surveillance cameras in the area.
According to some information, Women’s Health Consultants had a locked container for keeping sensitive documents due for disposal. But the center did not use the container. Instead, the records were simply put in a container accessible to unauthorized persons. The person who saw the files gave an anonymous message via the non-emergency line of Allentown Communication Center.
According to the tip, a city employee came to the recycling center and pushed the records in a container out of sight. Then the container became inaccessible to the public when it was loaded onto a truck to be sent to the recycling company. This privacy breach was reported to the Pennsylvania attorney general’s office. There’s no confirmed report if the incident has been investigated.
As far as physical records containing protected health information of patients are concerned, HIPAA requires secure disposal, which means that the information contained must be unreadable and undecipherable. Usually, disposal involves shredding, burning or pulping the files. If done off-site, transit shoud be secured to make sure the files are not accessed by unauthorized persons.
The Department of Health and Human Services’ Office for Civil Rights penalizes healthcare organizations that fail to dispose of medical records securely. Financial penalties can range from $100 to 50,000 per occurrence. The maximum penalty is $1,500,000. In 2015, Cornell Prescription Pharmacy paid OCR $125,000 to resolve an improper disposal case.