Parkview Owes $800,000 After HIPAA Violation
According to a Department of Health and Human Services press release, Fort Wayne-based Parkview Health System Inc. has agreed to pay $800,000 in a settlement after an investigation involving 71 cardboard boxes containing patients’ confidential information that were discovered unattended alongside a public road, not far from a busy shopping center.
A resolution posted on the HHS website states that Dr. Christine Hamilton filed a complaint in 2009 that Parkview had violated HIPAA privacy laws when employees dropped the boxes, containing confidential medical records for between 5,000 and 8,000 patients, off in her driveway and left.
According to the resolution Parkview was assisting Hamilton with the retirement process, including transferring patients to other physicians and had custody of the records. The resolution states that hospital employees knew Hamilton was not home and disregarded her request that the records not be dropped off at her home, thus violating HIPAA requirements that the information be “appropriately and reasonably” safeguarded.
In addition to the $800,000 settlement, Parkview has entered a Corrective Action Plan, which includes implementing safeguards to ensure that public health information is protected from disclosure in violation of the HIPAA privacy rule. The CAP requires Parkview to notify HHS in writing if an employee violates HIPAA policies and procedures, outlining the incident, details, who was involved, corrective actions and steps to resolve any harm that may have resulted from the incident.
Parkview has also agreed to provide training of employees who have access to confidential public records and to submit evidence of this training. Training on these approved policies and procedures will also be required for all employees. This extends to all Parkview-owned and controlled locations.
Parkview will also be required to maintain all documents pertaining to its CAP for six years.
The entire resolution agreement and press release can be read at www.hhs.gov/ocr/privacy/hipaa/enforcement/examples/parkview.html