DOW JONES NEWSWIRES
CVS Caremark Corp. (CVS) will pay $2.3 million as part of a
federal settlement to close a probe which found the giant
drug-store chain didn't adequately protect patient privacy when
disposing of data like identifying information on pill-bottle
labels.
The Department of Health and Human Services and the Federal
Trade Commission opened investigations into the company's practices
following media reports that alleged patient information was being
disposed of in industrial trash containers outside certain
stores.
The review found CVS failed to implement adequate procedures to
safeguard patient information during the disposal process and
didn't adequately train employees on how to properly get rid of
such information.
The settlement resolves potential violations of the Health
Insurance Portability & Accountability Act's privacy rule.
Besides making the payment, CVS also agreed to train employees
to deal with sensitive data, impose sanctions for noncompliance and
engage a third party to conduct assessments of its compliance.
The corrective-action plan from Health and Human Services will
be in place for three years, while the FTC requires monitoring for
20 years.
-By Lauren Pollock, Dow Jones Newswires; 201-938-5964;
lauren.pollock@dowjones.com
