UPDATE:CVS To Pay $2.25 Million To Resolve Patient Privacy Concerns
February 18 2009 - 12:09PM
Dow Jones News
CVS Caremark Corp. (CVS) will pay $2.25 million to settle
federal charges thatthe giant drug-store chain didn't adequately
protect patients'privacy when disposing of prescriptions, pharmacy
labels and other documents that contained sensitive medical and
financial information.
The U.S. Department of Health and Human Services and the U.S.
Federal Trade Commission opened investigations into the company's
practices following media reports in 2006 and 2007alleging that CVS
retail pharmacies were throwing out customer information in public,
unsecured trash dumpsters outsidecertain stores.
The federal probe found CVS failed to implement adequate
procedures to safeguard patient information during the disposal
process and didn't adequately train employees on how to properly
get rid of such information.
The FTC said that in addition to prescription drug information,
CVS employees improperly disposed of credit card receipts and
employee records.
CVS said in a statement that it wasn't aware of any consumer
harm arising out of the alleged incidents. The company denied
engaging in any wrongful conduct and said it agreed to settle the
matter to avoid the time and expense of further legal
proceedings.
"CVS Caremark is committed to being an industry leader in
privacy matters and places high priority on protecting the privacy
of its customers and plan participants," the company said.
Wednesday'ssettlement resolves potential violations of the
Health Insurance Portability & Accountability Act's privacy
rule.
Besides making the payment, CVS agreed to train employees to
deal with sensitive data, impose sanctions for noncompliance and
hire a third party to monitor its compliance.
-By Brent Kendall, Dow Jones Newswires; 202-862-9222;
brent.kendall@dowjones.com