Another blow for Concentra following $1.7 million fine

Last month, we announced a HIPAA breach by Concentra resulting in a colossal settlement of $1,725,220, after unencrypted laptops containing PHI were stolen. Shockingly, since the incident Concentra have again landed themselves in hot water after patient records were found discarded in a public recycling bin.

Despite claiming all patient records were transferred legally following the closure of their facility in February last year, the appalling discovery comes as another blow to Concentra’s substandard reputation for data handling. Accelerated Urgent Care has also come under fire after admitting possession of the records when the breach occurred.

23abc, alongside state agencies, is continuing to investigate the breach to uncover the parties responsible. With contractual agreements preventing Concentra from identifying who the facility was sold to, it currently remains a mystery as to how the sensitive documents were abandoned in such a public manner.

Irrespective of who was responsible for the improper disposal of the records, the development should serve as a lesson to all healthcare professionals and organizations – at every stage of data handling ensure HIPAA compliant administrative, technical, and physical safeguards are in place.

When disposal is required, be sure to choose the most appropriate method. Examples from the Department of Health and Human Services (HHS) include:

• For PHI in paper records, shredding, burning, pulping, or pulverizing the records so that PHI is rendered essentially unreadable, indecipherable, and otherwise cannot be reconstructed.
• Maintaining labeled prescription bottles and other PHI in opaque bags in a secure area and using a disposal vendor as a business associate to pick up and shred or otherwise destroy the PHI.
• For PHI on electronic media, clearing (using software or hardware products to overwrite media with non-sensitive data), purging (degaussing or exposing the media to a strong magnetic field in order to disrupt the recorded magnetic domains), or destroying the media (disintegration, pulverization, melting, incinerating, or shredding).