WHEN A BILLING SERVICE company disposes of patients’ lab test records, it should do so in compliance with federal and state privacy rules. That means all protected health information (PHI) should be shredded or incinerated.
Four pathology groups in Massachusetts learned this lesson the hard way when they and their billing company agreed to pay collectively $140,000. This settled charges of illegal dumping of patients’ records in the town dump in Georgetown. Massachusetts State Attorney General Martha Coakley announced the settlement on January 7.
In a court complaint, Coakley alleged that Joseph and Louise Gagnon, doing business as Goldthwait Associates, a pathology billing company in Marblehead, violated state data security laws when they mishandled and improperly disposed of medical records at the Georgetown dump.
The records contained PHI from four Massachusetts pathology groups, Coakley said. The medical records contained unredacted names, Social Security numbers, and medical diagnoses from more than 67,000 patients, Coakley said in a statement.
In July 2010, a photographer for The Boston Globe noticed the papers in a pile at the dump and alerted the newspaper. The photographer saw a “huge pile of paper 20 foot wide by 20 foot long,” the newspaper reported.
Jane Pine Wood, an attorney with McDonald Hopkins, observed to lab directors and pathologists that Coakley filed this complaint under state rules regarding PHI. Wood advised that labs nationwide could be liable for similar security violations under the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA).
Responsible for Others’ Acts
“This case shows that any healthcare provider is responsible for what its business associates do with patient records,” Wood commented. “When this case first became news, we alerted our clients that they need to be careful when working with billing companies. It is important to get assurances from these companies that all patients’ records are disposed or destroyed in appropriate ways.”
The defendants involved in the settlement were Joseph and Louise Gagnon, former owners of Goldthwait Associates; Kevin B. Dole M.D., former President of Chestnut Pathology Services, PC; Milford Pathology Associates, PC; Milton Pathology Associates, PC; and Pioneer Valley Pathology Associates, PC.
Clinical laboratories and pathology groups may want to conduct a proactive review as to how patient records are handled to avoid violations of HIPAA and state laws. Since HIPAA took effect, a reg- ular number of PHI breaches have made local and national news.
