New England Dermatology and Laser Center, P.C.

New England Dermatology, P.C., d/b/a New England Dermatology and Laser Center (NEDLC) has paid $300,640 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and agreed to implement a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule. NEDLC is located in Massachusetts and provides dermatology services. On May 11, 2021, NEDLC filed a breach report with OCR stating that empty specimen containers with protected health information on the labels were placed in a dumpster in their parking lot. All of NEDLC’s specimen containers had a label that included patient names, dates of birth, dates of sample collection, and name of the provider who took the specimen. OCR’s investigation found potential violations of the HIPAA Privacy Rule including impermissible uses and disclosures of PHI and failure to maintain appropriate safeguards to protect the privacy of PHI. “Improper disposal of protected health information creates an unnecessary risk to patient privacy,” said Acting OCR Director Melanie Fontes Rainer. “HIPAA regulated entities should ensure that reasonable and appropriate safeguards are in place so protected health information is not disclosed when disposed in dumpsters or other containers accessible by the public.”