Rite Aid Corporation has agreed to pay $1 million to settle any violations of the Health Insurance Portability and Accountability Act, commonly referred to as HIPAA, to the U.S. Department of Health and Human Services.  The HHS Office for Civil Rights along with the Federal Trade Commission began a joint investigation of Rite Aid Corporation after videotapes showing Rite Aid pharmacies disposing of prescriptions and pill bottles into a trash container accessible to the public.  Unfortunately, the bottles were still labeled with customers’ personal information, and that is a clear violation of HIPAA.

According to the press release, Rite Aid Corporation had also allegedly failed to implement adequate policies to protect patient privacy during the disposal process, appropriately train employees on how to dispose of private information, and maintain sanctions for employees who failed to properly dispose of patient information.

Along with the $1 million settlement, Rite Aid Corporation has also agreed to implement corrective actions to ensure this sort of violation does not occur again.  The program to be implemented includes:

• Revising and distributing policies and procedures, including sanctions, to ensure privacy is not violated during disposal.
• Training all workers on new requirements
• Having internal monitoring in place to ensure procedures are being followed
• Hiring an independent third-party assessor to ensure procedures are being followed