HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Safeway Fined $10 Million for Improper Disposal of Pharmacy Records and Waste

California prosecutors have reached a $9.87 million settlement with the grocery store chain Safeway for improperly disposing of pharmacy records and hazardous waste in dumpsters.

The patient records contained private and confidential medical information and should have been destroyed or rendered unreadable according to California’s Confidentiality of Medical Information Act and the Health Insurance Portability and Accountability Act. Safeway had been disposing of waste and patient pharmacy records improperly for a period of over seven years according to prosecutors.

The case relates to a series of waste inspections conducted by state regulators between 2012 and 2013. Inspectors checked the waste at dozens of stores operated by the grocery chain over a period of 18 months. The waste found in dumpster used by Safeway stores was destined for landfill sites. The inspections revealed that approximately 40% of the stores had violated state laws by failing to stop controlled items from being dumped along with regular waste.

In a number of cases the inspectors found documents containing medical information and personal details of visitors to its pharmacies, in addition to discarded pharmaceutical products, aerosols, batteries, ignitable liquids and electronic equipment in addition to corrosive and toxic waste.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

According to a statement issued by the Alameda District Attorney’s Office, “The inspections revealed that Safeway was routinely and systematically sending hazardous wastes to local landfills, and was failing to take measures to protect the privacy of their pharmacy customers’ confidential medical information.”

As Alameda District Attorney, Kenneth Mifsud, pointed out in the statement, “There’s a risk of identity theft committed by dumpster divers, and unfortunately by some members of staff.”

The statement confirms that the issues have now been addressed: “Safeway worked cooperatively to remedy the issue, enhance its environmental compliance program and train its employees to properly handle such waste.”

Safeway had policies in place to ensure waste was disposed of correctly, but those policies were not put into action across all stores and the staff had not received sufficient training on the correct methods to be used to dispose of hazardous waste and patient records.

The case was filed at the Superior Court in Alameda County on December 31st with a claim also filed by District Attorneys on the same day; however discussions over the investigator’s findings commenced as soon as the chain was alerted to the investigator’s findings in 2012, with the cases being filed as a formality.

The $9.87 in civil costs relate to the environmental violations and unfair business claims, the latter also covering the potential exposure of confidential records. It is not clear how many patients were potentially affected as the offences potentially date back 7 years and the inspectors only checked a small number of dumpsters used by the chain.

In addition to the financial penalty, Safeway must “maintain, and enhance, as necessary” its policies covering the disposal of confidential waste and patient records and staff must receive training on correct waste disposal to prevent further incidents from occurring.

Safeway operates over 500 stores in California under its own name as well as other brands such as Pavilions, Pak ‘n’ Save and Von’s and it is soon to bring a number of Albertsons stores under its umbrella following its merger. The resolution agreement relates to around 500 of its stores.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.