Colorado Pharmacy Reaches HIPAA Settlement

Last month, the U.S. Department of Health and Human Service’s Office for Civil Rights (OCR) announced that Cornell Prescription Pharmacy (Cornell Pharmacy)  in Denver, Colorado agreed to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA).

As part of the settlement, Cornell Pharmacy has agreed to pay a $125,000 penalty and enter into a two year Corrective Action Plan (CAP) to improve its HIPAA compliance program.

OCR was first made aware of Cornell Pharmacy’s HIPAA violations in January 2012 after a local Denver news outlet reported that Cornell Pharmacy appeared to have disposed of unsecured documents containing protected patient information into a public dumpster. After investigating, OCR confirmed that the documents contained the private health information of over 1,600 patients.

During its investigation, OCR also found that Cornell Pharmacy had not implemented written policies and procedures or provided adequate HIPAA training to its workforce as required by HIPAA . Cornell Pharmacy, pursuant to its CAP, will develop and adopt written HIPAA policies and procedures that must be reviewed and approved by OCR.