Medical Records from Pennsylvania Obs/Gyn Clinic Found at Public Recycling Center
Paper files containing names, Social Security numbers, and medical histories, including details of cancer diagnoses and sexually transmitted diseases, have been dumped at a recycling center in Allentown, Pennsylvania.
The files appear to have come from Women’s Health Consultants, an obstetrics and gynecology practice that had centers in South Whitehall Township and Hanover Township, PA. Women’s Health Consultants is no longer in business.
How the records came to be dumped at the recycling center is unknown as the container where the records were disposed of was not covered by surveillance cameras.
The center does have a locked recycling container where sensitive documents containing confidential information can be disposed of securely, but that container was not used. The records were dumped in a container where they could be accessed by unauthorized individuals.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The person who discovered the files left an anonymous tip on the non-emergency line of the Allentown communication center. According to The Morning Call, a city employee visited the recycling center and pushed the records further into the container, so they were no longer visible. The container has since been loaded onto a truck and is no longer accessible by the public. The container will be sent on to a recycling company.
The privacy breach has been reported to the Pennsylvania attorney general’s office, although it is unclear whether an investigation into the incident has been launched.
HIPAA requires all physical records containing patients’ protected health information to be disposed of securely, rendering all information unreadable and indecipherable, so that it cannot be reconstructed. For paper records, this typically involves shredding, pulping, or burning the files. If that process is to occur off-site, the records should be secured in transit to ensure they cannot be accessed by unauthorized individuals.
The failure to dispose of records securely can attract a significant financial penalty, ranging from $100 to $50,000 per instance, up to a maximum of $1,500,000.
The Department of Health and Human Services’ Office for Civil Rights has already punished healthcare organizations for improperly disposing of medical records. In 2015, Cornell Prescription Pharmacy settled an improper disposal case with OCR for $125,000.
