When recommending best practices, federal privacy and security officials stress that organizations need to follow their protected health information (PHI) wherever it “lives,” as HIPAA rules require safeguarding no matter the location.

“In the dumpster” should now be on that data map if it wasn’t already, in light of a new $300,000 settlement between a dermatology practice and the HHS Office for Civil Rights (OCR) that includes a two-year corrective action plan (CAP).^[1]

In March 2021, a security guard found a single-specimen container “bearing a label containing PHI” in a parking lot used by New England Dermatology and Laser Center (NEDLC).^[2] NEDLC admitted to OCR that such containers were added to its “regular waste, bagged and placed in an exterior dumpster accessible via the parking lot, without alteration to the PHI containing label.”

Along with the settlement, OCR issued FAQs about proper disposal of PHI.^[3] For privacy attorney Joseph Lazzarotti, the breach and settlement drive home a number of other lessons, including that organizations need to understand the expansiveness of what constitutes PHI.

And although just one was found that day, NEDLC said it disposed of containers this way for 10 years—beginning Feb. 4, 2021, and ending the day the security guard appeared. OCR’s online breach reporting website lists 58,106 affected patients, a number that, oddly, is not mentioned in the settlement agreement OCR announced Aug. 23.

Also not included is the fact that this was NEDLC’s second breach—of relatively the same type—in four years, which may help explain the size of the settlement. In 2018, NEDLC acknowledged it had “improperly disposed of patient records…by failing to shred them prior to disposal in a dumpster,” according to OCR’s breach portal.^[4]

Founded in 1954, NEDLC has nine physicians operating from four locations in Massachusetts, with a service area that spans western Massachusetts, northern Connecticut and southern Vermont, according to its website.

The settlement documents do not identify the location involved in the 2021 breach, which NEDLC reported to OCR on May 11 of that year. The agency said the labels on specimen containers listed “patient names, dates of birth, dates of sample collection, and name of the provider who took the specimen.”