Medical Records Dumping

On June 4, 2009, Parkview employees improperly returned the 71 cardboard boxes of medical records to the retiring physician by leaving them in the physician’s driveway unattended where they were accessible to individuals who were not permitted to have access to the records. The physician had refused the return of the records and Parkview knew the physician was not at home when its employees delivered the records to the physician’s home.

The HIPAA regulations require every covered entity to appropriately safeguard protected health information under their control. Parkview did not meet that requirement when it returned the retiring physician’s medical records and left then in the physician’s driveway unattended. According to the OCR, the medical records were left within 20 feet of a public road and very near a public shopping area. Parkview’s solution for disposing of these old medical records turned out to be more expensive than the proper disposal would have been.

Healthcare providers retire, relocate, or cease practicing for numerous reasons. Healthcare facilities merge with other facilities, and occasionally cease operations. Those healthcare providers and facilities are still required to maintain their records so that patients can access their records when needed, even if it is several years after the patient received care from the healthcare provider or facility. The records of active patients are fairly easy to transition to another healthcare provider or facility. Old patient records are almost impossible to transition to another provider or facility. Usually, a healthcare provider or facility will need to pay a record custodian to maintain their old medical records. While a paid record custodian is not cheap, a paid record custodian will usually cost less than $800,000.

Parkview inadvertently became the record custodian of the retiring physician by agreeing to take custody of the physician’s medical recors. Once Parkview took custody of the retiring physician’s medical records, it had an obligation to maintain the confidentiality of those records as required by HIPAA. Parkview’s attempt to return the medical records to the physician was not in compliance with HIPAA and resulted in a significant penalties imposed on Parkview by the OCR.

All healthcare providers and healthcare facilities need to be cautious about inadvertently becoming responsible for maintaining the medical records of another provider or facility. Before healthcare providers and facilities that take control of another provider’s medical records, they should have an unambiguous agreement on how those records will be returned to the original provider or facility. Apparently, Parkside did not have such an agreement with the retiring physician, which allowed the physician to refuse the return of the records.

The settlement with Parkview should also serve as a reminder to covered entities that HIPAA applies to paper records. While most of the recent settlements announced by the OCR have involved electronic records, the improper disclosure of paper records is still a significant problem. The incidence of dumping paper records may actually increase as healthcare providers and facilities transition to electronic records. The HIPAA regulations require healthcare providers and facilities to destroy paper records. Paper records are destroyed by shredding, burning, or otherwise rendering the information unreadable. A paper record is destroyed if it cannot be reconstructed. Disposing of paper records in dumpsters does not destroy the record.

The $800,000 settlement with Parkview is higher than previous cases involving paper records. The OCR has imposed significantly higher fines for HIPAA breaches in the last year. More importantly, the OCR intends to impose even higher fines in the future. In comments made at a recent American Bar Association conference, Jerome B. Meites, OCR chief regional counsel for Chicago, stated the OCR intends to impose even larger fines for HIPAA breaches in 2014.