This summer I had planned to do a dumpster-diving project with my sons, but then the Iowa floods postponed those plans. However, after reading the following I’m motivated to plan to do this in the spring after basketball and G&T activities are finished for the winter…
“Private medical records found in trash: Boxes with documents detailing confidential information found next to Laguna Hills medical office building.”
A photo of the box of financial records including medical records with the patient files is in the article.
Patient privacy in general, and HIPAA compliance in particular, is a huge problem within small to medium sized medical providers. Yes, along with some large providers. But so many of the small to medium sized medical clinics I’ve talked to, when I ask them if they feel they are in compliance with HIPAA, smile confidently and dig out a notice of privacy protection (NPP) from deep within their drawers, hold it up and say, “Yes! We have paper right here!” However, they overwhelmingly do not realize that there is more to HIPAA than that NPP. Wait, I take that back…there is widespread misconception in provider offices that HIPAA also prohibits medical staff from telling patients and patients’ families any of their own protected health information (PHI).
The amount of intact PHI just tossed into publicly-accessible trash bins, not only at medical clinics but also behind a large number of other types of organizations and businesses, is completely ridiculous.
Looks like a grassroots education effort is needed!
Tags: awareness and training, data disposal, HHS, HIPAA, Information Security, IT compliance, IT training, patient privacy, PHI, policies and procedures, privacy training, risk management, security training