HIPAA, the Health Insurance Portability and Accountability Act, is a household term these days, primarily because you have to sign one of those privacy forms whenever you go to the doctor’s office. Of course, that doesn’t mean that everyone has a full grasp on everything HIPAA does and does not do, but most people understand the part about your personal health records being protected from unauthorized disclosure. Having worked in two different hospitals, I can also assure you that providers are well versed in the law and the penalties faced by both health care organizations and individuals who violate its terms.
For the most part, complying with the law is simple enough. If I work in a lab, I don’t tell someone else the results of your blood tests. In fact, I don’t even tell them that you came in to be tested. There are other similar examples, where the disclosure is obviously way out of line. But sometimes information gets disclosed in other ways, perhaps because people just weren’t thinking. That seems to be the case with a handful of national pharmacy chains–at the very least CVS, Rite-Aid, and Walgreens–that were discarding old prescriptions and pill bottles containing patient information on them, without first rendering those items impossible to identify. The mistakes are proving costly, as Rite Aid recently settled with the Dept. of Health and Human Services for $1 million. CVS settled last year for $2.25 million, and Walgreens looks to be working on a settlement right now. Personally, I think it’s ironic that with all the attention given to the risk of disclosure from electronic records, one of the biggest HIPAA slip-ups to date has come from people throwing stuff in the trash without taking the necessary precautions.