The Office of Civil Rights, which handles HIPAA investigations and sanctions, alleged a client of
Amador Law Corporation had placed medical records in a dumpster in the course of moving a medical practice that had been acquired by the client. It even had photos of records that were in fact old records of the acquired practice.
After several providing various legal and factual arguments, and various documents, including
declarations from those persons involved in the move and evidence that the client took precautions to protect PHI, the OCR closed the case without any sanctions or other adverse actions.
It was important in resolving the case that the client had its policies and procedures up to date,
had implemented physical and IT safeguards, and had asked the complaining party to provide any
evidence of the alleged breach so it could mitigate.
The OCR was very responsive and took the allegations of breach very seriously. Any provider
that is out of compliance is vulnerable to sanctions in the event of a complaint to the OCR.