Pharmacy chain Rite Aid Corp. has agreed to pay $1 million and take corrective action in a settlement with HHS resolving potential violations of the privacy provisions of the Health Insurance Portability and Accountability Act of 1996.
Rite Aid also entered a consent agreement with the Federal Trade Commission, which investigated the matter with HHS' civil rights office after television media outlets videotaped incidents suggesting that employees of the company's pharmacies were disposing of prescriptions and labeled pill bottles in publicly accessible trash bins. The agreements stipulate that they do not represent a concession of liability by Rite Aid.
Rite Aid spokeswoman Cheryl Slavinsky said the company cooperated with agencies and has reviewed and strengthened its policies and procedures for protecting private information. "We will continue to work with FTC and HHS to ensure that comprehensive privacy procedures are working and being followed across the chain," Slavinsky said. "We are not aware of any harm to customers or patients arising from the investigated incidents," she added.
The agreements call for the company to revise its policies, train its workforce on new requirements, conduct internal monitoring and obtain an independent review of its security program every two years for the next two decades.
In February 2009, CVS agreed to pay $2.25 million and entered agreements with HHS and the FTC likewise resolving investigations into the disposal of refuse that contained identifying information.