The recent settlement between a dermatology practice and the HHS Office for Civil Rights (OCR) for $300,640 the agency said reflected 10 years of inappropriate disposal of specimens^[1] isn’t the first time it has cracked down on a covered entity (CE) or business associate (BA) for tossing out protected health information (PHI) .

It’s at least the third.

But this time, OCR issued a four-page guidance document consisting of six FAQs along with news of the settlement.^[2] The FAQs address the basics of what both the Privacy and Security Rules require when it comes to disposal; they also touch on the somewhat unrelated but oft-lingering question of retention requirements under HIPAA (spoiler alert: there are none).

In the guidance, OCR repeatedly makes one point: organizations “are not permitted to simply abandon PHI or dispose of it in dumpsters or other containers that are accessible by the public or other unauthorized persons.”

To begin, OCR explained that the Privacy Rule requires CEs “apply appropriate administrative, technical, and physical safeguards to protect the privacy” of PHI “in any form. This means that covered entities must implement reasonable safeguards to limit incidental, and avoid prohibited, uses and disclosures of PHI, including in connection with the disposal of such information.”

Meanwhile, the Security Rule “requires that covered entities implement policies and procedures to address the final disposition of electronic PHI and/or the hardware or electronic media on which it is stored, as well as to implement procedures for removal of electronic PHI from electronic media before the media are made available for re-use,” according to the guidance.