Proving HIPAA violations with physical proof

[ccm]

What is the name of your state? California.

I have found out that a doctor is throwing patient records with names, addresses, and symptoms/diagnoses in the trash. How should I properly report this to the OCR? Should I recover some of these paper records from the trash (it is in a public area) and post them attached to a violation report? Is me handling these papers a HIPAA violation? Is posting these papers through USPS to the OCR a HIPAA violation? This has been ongoing for months and I want to report it for the sake of the patients but I do not want to violate the Act myself.

 

[justalayman]

You stealing from a dumpster is theft

Maybe walking into the business and reminding them of the violation would be adequate


Take a picture of the records and send that to the proper agency

 

[Taxing Matters]

What is the name of your state? California.

I have found out that a doctor is throwing patient records with names, addresses, and symptoms/diagnoses in the trash. How should I properly report this to the OCR? Should I recover some of these paper records from the trash (it is in a public area) and post them attached to a violation report? Is me handling these papers a HIPAA violation? Is posting these papers through USPS to the OCR a HIPAA violation? This has been ongoing for months and I want to report it for the sake of the patients but I do not want to violate the Act myself.

Violations of the federal Health Insurance Portability and Accountability Act (HIPAA) are enforced by the U.S. Department of Health and Human Services (HHS). See the information on HHS HIPAA complaints for more on making the complaint to its Office of Civil Rights (OCR). you can do it online if you want. I would recommend that you not take patient records out of the trash, especially if you are an employee of that doctor or facility. That might get you fired and might also result in HIPAA violations.

 

[ccm]

You stealing from a dumpster is theft

Maybe walking into the business and reminding them of the violation would be adequate


Take a picture of the records and send that to the proper agency

This is not a dumpster. It is a garbage can left in the street outside a home. Collecting e.g. cans from these bins is not illegal.
https://en.wikipedia.org/wiki/California_v._Greenwood

Taking HIPAA records may be illegal because those have different regulations.

 

[ccm]

I would recommend that you not take patient records out of the trash, especially if you are an employee of that doctor or facility. That might get you fired and might also result in HIPAA violations.

I am not an employee but this is my concern. I do not want to have a HIPAA violation because I filed a complaint with improper actions. Without proof though, the OCR will probably not do anything. I will just leave things as they are. Bad doctor, poor patients.

 

[justalayman]

This is not a dumpster. It is a garbage can left in the street outside a home. Collecting e.g. cans from these bins is not illegal.
https://en.wikipedia.org/wiki/California_v._Greenwood

Taking HIPAA records may be illegal because those have different regulations.

That case had nothing to do with taking anything from the trash. It had to do with whether a search warrant is required to search trash, more specifically, is there an expectation of privacy.


Taking property from a refuse can is theft. The ownership rights are based on a contract between the resident of the property and the entity hired to collect the trash. The entity picking up the trash has salvage rights to the contents of the trash. Whether it sits at the curb or remains on the curtilage of the home doesn’t change the rights held in the trash.

 

[justalayman]

I am not an employee but this is my concern. I do not want to have a HIPAA violation because I filed a complaint with improper actions. Without proof though, the OCR will probably not do anything. I will just leave things as they are. Bad doctor, poor patients.

There is no chance of you getting a “HIPAA complaint” because you are not a covered entity.

A photograph would provide adequate evidence of the violation


Apparently this is not a situation you truly believe should be reported or you wouldn’t stop now simply because you are not allowed to take property from a trash receptacle.

 

[quincy]

What is the name of your state? California.

I have found out that a doctor is throwing patient records with names, addresses, and symptoms/diagnoses in the trash. How should I properly report this to the OCR? Should I recover some of these paper records from the trash (it is in a public area) and post them attached to a violation report? Is me handling these papers a HIPAA violation? Is posting these papers through USPS to the OCR a HIPAA violation? This has been ongoing for months and I want to report it for the sake of the patients but I do not want to violate the Act myself.

You can file a complaint through the link to the US Department of Health and Human Services provided earlier and you can report the breach of confidentiality to California's Medical Board at: http://www.mbc.ca.gov/Consumers/Complaints/

Patient records should not be disposed of in dumpsters where the public has legal access to the trash.

Prior to disposal, medical records should be shredded properly.

https://www.hhs.gov/hipaa/for-professionals/faq/576/may-a-covered-entity-dispose-of-information-in-dumpsters/index.html

Patients whose medical health information has been compromised should be contacted by the entity and told of the breach in confidentiality.

There has been media coverage given to medical records discovered in trash receptacles before - and contacting the media in your area is another option for you to consider.

 

[ccm]

There is no chance of you getting a “HIPAA complaint” because you are not a covered entity.

A photograph would provide adequate evidence of the violation


Apparently this is not a situation you truly believe should be reported or you wouldn’t stop now simply because you are not allowed to take property from a trash receptacle.

No, I think this is a serious issue. I just do not want to so something bad myself. Are you saying that taking a photograph of the papers in the trash and including that in a complaint would be legal?

 

[ccm]

You can file a complaint through the link to the US Department of Health and Human Services provided earlier and you can report the breach of confidentiality to California's Medical Board at: http://www.mbc.ca.gov/Consumers/Complaints/

Patient records should not be disposed of in dumpsters where the public has legal access to the trash.

Prior to disposal, medical records should be shredded properly.

https://www.hhs.gov/hipaa/for-professionals/faq/576/may-a-covered-entity-dispose-of-information-in-dumpsters/index.html

Patients whose medical health information has been compromised should be contacted by the entity and told of the breach in confidentiality.

There has been media coverage given to medical records discovered in trash receptacles before - and contacting the media in your area is another option for you to consider.

Thank you for the information. I will consider contacting a local newspaper the next time this happens.

 

[justalayman]

No, I think this is a serious issue. I just do not want to so something bad myself. Are you saying that taking a photograph of the papers in the trash and including that in a complaint would be legal?

Abdolutely. The case you cited does speak to there being no expectation of privacy. That is why it is a hipaa violation as well as allows you to photograph the materials.

 

[quincy]

Thank you for the information. I will consider contacting a local newspaper the next time this happens.

Speaking to the media about the breach can insulate you from any repercussions as your identity can remain confidential. The media outlet will investigate your claim and authorities will be informed of the improper disposal of the medical records.

It is important that the breach is disclosed so patients whose private information was exposed can take steps to protect themselves from identity thieves.

Good luck.

 

[ccm]

Thank you both. I am sorry for being flippant the other day. I do take this seriously and I will take action to protect the patients.

 

[quincy]

Thank you both. I am sorry for being flippant the other day. I do take this seriously and I will take action to protect the patients.

I think reporting the improper disposal of patient records is the proper step to take, however you decide to make the report.

We all appreciate the thanks. Good luck.