HHS Announces $1 Million HIPAA Settlement

The U.S. Department of Health and Human Services has reached a $1 million settlement with Rite Aid Corp. over alleged violations of the Health Insurance Portability and Accountability Act (HIPAA.)

The settlement, announced yesterday, stems from an investigation into the pharmacy chain’s disposal of pill containers. The HHS Office of Civil Rights stated that Rite Aid had thrown out pill bottles containing identifiable patient information in unsecured industrial trash containers that were accessible to the public. The practice ran afoul of HIPAA’s privacy rules, stated OCR officials.

In other findings, federal authorities said Rite Aid failed to implement adequate policies to safeguard patient information, failed to adequately train employees and did not maintain a sanctions policy against noncompliant employees. Rite Aid agreed to a resolution agreement and corrective plan that addresses those issues and also agreed to engage a third-party assessor to monitor its efforts and report back to HHS.

The HIPAA Privacy Rule requires health plans, healthcare clearinghouses and most healthcare providers, including hospitals, to safeguard the privacy of patient information at all points, including disposal.