A Dermatology Clinic Threw Patient Labels in a Dumpster. It Cost Them $300,640.

No shredder. No documentation. No disposal policy. Just a bin behind the building and a HIPAA violation waiting to be found.

A dermatology practice in Massachusetts disposed of specimen containers with patient information attached directly to the outside. Names, dates of birth, and physician names were all on the labels, all readable, and all left in an unsecured dumpster with no record of how disposal was handled.

The HHS Office for Civil Rights opened an investigation. In August 2022, New England Dermatology and Laser Center settled for $300,640.

What the OCR found

The investigation did not uncover a sophisticated failure. It found the absence of anything at all.

No policies governing the disposal of protected health information. No evidence of a documented disposal process. No safeguards to ensure PHI was rendered unreadable before it left the facility. The practice had been disposing of materials containing patient data without any procedure in place to verify or record that disposal was handled correctly.

The OCR’s position was straightforward: HIPAA requires covered entities to implement policies for the final disposition of PHI and the hardware and media on which it is stored. The absence of those policies, and the absence of any proof that disposal was handled appropriately, was sufficient for a penalty.

The $300,640 settlement also came with a corrective action plan requiring the practice to develop and implement proper disposal policies going forward.

What this case tells smaller organizations

This case did not involve a large hospital system or a global bank. It involved a dermatology clinic.

The exposure is the same regardless of size. Any organization that handles protected health information and cannot demonstrate that PHI was disposed of properly faces the same regulatory risk. The OCR does not apply a different standard to small practices. What changes is the scale of the penalty, not the requirement.

The pattern that appears across HIPAA enforcement is consistent: violations are rarely the result of sophisticated attacks. They are the result of disposing of sensitive information without a verifiable process for doing so.

What would have prevented it

The OCR’s finding came down to two things: no policy and no proof.

For physical PHI, the proof is a documented destruction record such as a shredding certificate, a chain of custody log, or other evidence that disposal was handled and recorded.

For digital storage, the equivalent is a Certificate of Sanitization. When a drive is cryptographically erased, the data is rendered unrecoverable. When that erase is documented, the organization has proof tied to a specific device, a specific date, and a specific action, confirming that disposal was handled correctly.

Opal Lock by Fidelity Height performs cryptographic erase on compatible TCG Opal and Pyrite self-encrypting drives and generates a Certificate of Sanitization after each successful erase. The certificate provides the documentation that regulators ask for: what was erased, when, and by whom.

The principle the OCR applied to specimen containers applies equally to storage devices. Disposal without documented, verifiable proof is a liability. Disposal with it is a defensible record.

Compare Opal Lock editions at fidelityheight.com/shops/

Sources: HIPAA Journal | TechTarget | Becker’s Hospital Review | HHS OCR