On August 23, 2022, the Office for Civil Rights (OCR) issued a press release announcing that it had settled with New England Dermatology, P.C. (NED) for $300,640 “over the improper disposal of protected health information.”

The OCR’s investigation began after NED submitted a breach report stating that

“empty specimen containers with protected health information on the labels were placed in a garbage bin in their parking lot. The containers’ labels included patient names and dates of birth, dates of sample collection, and name of the provider who took the specimen.”

The OCR’s investigation found potential violations of HIPAA, “including the impermissible use and disclosure of PHI and failure to maintain appropriate safeguards to protect the privacy of PHI.”

NED agreed to a “robust corrective action plan” in addition to the monetary settlement.