The hits just keep on coming. HHS announced June 23  that OCR entered into resolution agreement and $800,000 settlement with Parkview Health System, Inc., in Fort Wayne, Indiana, for alleged HIPAA Privacy Rule violations.
Parkview obtained the medical records of 5,000–8,000 patients while helping Dr. Christine Hamilton transition her patients to new providers upon her retirement. It was believed that the health system was interested in purchasing a portion of Dr. Hamilton’s practice. Parkview failed to safeguard the PHI of these patients when its employees left 71 cardboard boxes of these medical records outside the physician’s home while she was not there. The home is within 20 feet of a public road and is near a shopping center, according to the press release.
The resolution agreement provides  that Dr. Hamilton filed the complaint against Parkview. The investigation revealed that when Parkview employees left the medical records at Dr. Hamilton’s home, they were aware that she was not there and had previously refused the delivery of the records.
Parkview’s corrective action plan states that it will do the following:
- Develop, maintain, and revise written HIPAA Privacy Rule policies and procedures for its workforce with HHS approval
- Distribute HHS-approved policies and procedures to members of its workforce
- Ensure that new, approved policies and procedures provide for administrative, technical, and physician safeguards to protect PHI
- Notify HHS in writing within 30 days of a violation of the new, approved policies and procedures
- Provide general safeguards training for its workforce members who have access to PHI