Several sources reporting on a recent breach in the Kansas City area appear to misunderstand HIPAA. Apparently, a former abortion doctor threw the paper records of abortions that he had conducted into a dumpster at an elementary school here in Overland Park, Kansas, practically down the street and around the corner from my office. The bin contained more than 1,000 records, many of minors, including names, birth dates, telephone numbers, Social Security numbers, emergency family contacts, health history, number of children, term of pregnancy, and previous abortions, if any, along with fees paid for the procedures.

But although the HITECH Act expanded HIPAA criminal liability to include “employees and other individuals,” improper disposal would not appear to be a criminal violation. And strong doubt exists that the former doctor, who lost his license a few years ago, is or was even a covered entity. He stated that he was a cash-only business, which seems likely for an abortionist. Some of the records did have insurance numbers on them, but unless he transmitted such data in connection with a standard transaction in electronic format, he was not a covered entity before he lost his license, and even if he was such then, it would seem that he would no longer be a covered entity now that he is not practicing medicine. Thus, gross as it was, it was not a HIPAA violation.

Another commentator opined that he could not be disciplined under HIPAA because HIPAA does not proscribe any standards for the proper destruction of paper records. Although it does not do so in terms, the Privacy Rule’s requirement for “appropriate safeguards” to protect PHI from misuse would certainly require paper records to be shredded, incinerated, or the like. The lack of specific standards did not prevent the $2.25 million dollar fine against CVS pharmacy for improper disposal of pharmacy vials and prescriptions.

Any thoughts? And thanks to the woman who found them unsecured and took appropriate action. The records are now safeguarded.

Read more in this article from the Kansas City Star.