HIPAA Journal has an update to a situation I had previously noted on this site – a hospital that failed to remove stored medical records from a building before its new owner took possession – despite, the new owner says, repeated calls on his and a realtor’s part alerting them to the situation. The hospital attempted to shift responsibility to the purchaser and even reported to the police that the records had been stolen. Of course, there was no such theft, and the hospital’s failure to remove the records is on them, not the purchaser.
In noting the breach, I had prefaced it with “Paging HHS to Aisle 4.”
HIPAA Journal also notes the potential HIPAA violation:
Under the HIPAA Security Rule, covered entities must ensure paper records containing PHI are stored securely and when no longer required, are securely disposed of and rendered unreadable and indecipherable. It was not the hospitals (sic) intention – it appears to be a case of poor communication – but technically the hospital sold the medical records with the property once the sale was finalized.
The records are now secure and do not appear to have been compromised so no risk of PHI exposure is understood to exist. However, as far as Crone is concerned the matter will not be resolved until he receives an apology.
Read more on HIPAA Journal. I suspect HHS will investigate this incident as this is a real what-might-have-been cautionary tale.
The incident was added to HHS’s public breach tool this week. Boyd reported it as affecting 8,300 patients.
Thanks to @6thDC for alerting me to the update.