In a press release dated July 27, 2010, the Department of Health and Human Services announced a settlment under which Rite Aid Corporation and its affiliates have agreed to pay $1 million to settle potential HIPAA violations. The pharmacy chain also entered into a consent order with the Federal Trade Commission.
HHS reports that the investigation was triggered by television media videotaped incidents in which pharmacies were shown to have disposed of prescriptions and labeled pill bottles containing individuals’ identifiable information in industrial trash containers that were accessible to the public. Rite Aid stores were among the pharmacies shown in the videos.
Under the HHS resolution agreement, in addition to the $Million restitution payment, Rite Aid must implement a three-year corrective action program that includes:
- Revising and distributing its policies and procedures regarding disposal of protected health information and sanctioning workers who do not follow them;
- Training workforce members on these new requirements;
- Conducting internal monitoring; and
- Engaging a qualified, independent third-party assessor to conduct compliance reviews and render reports to HHS.
The HHS Resolution Agreement and Corrective Action Plan can be found on the OCR Website here.