Dive Brief:
- Kaiser Permanente, California’s largest healthcare provider, will pay the golden state up to $49 million, including penalties, to settle allegations that the company violated HIPAA by improperly disposing of thousands of private medical records, hazardous materials and medical waste, including bodily fluids and syringes, in dumpsters headed for local landfills.
- Kaiser must also retain an independent third-party auditor for five years to perform no fewer than 520 trash compactor audits annually at California facilities to ensure future compliance with waste disposal regulations and handling of patient health information.
- The settlement concludes an eight-year investigation, during which district attorneys’ offices reviewed contents of unsecured dumpsters and found “hundreds of items” of hazardous waste and over 10,000 paper records containing health information of over 7,700 patients.
Dive Insight:
The investigation was the joint effort of six district attorneys from Alameda, San Bernardino, San Francisco, San Joaquin, San Mateo and Yolo counties. The California Department of Justice later joined the investigation, expanding it to examine Kaiser facilities statewide.
In the original complaint, filed in the Superior Court in the State of California, attorney general Rob Bonta argued that the investigation uncovered the healthcare provider had violated a slew of federal and state regulations by improperly disposing of waste.
The state alleged Kaiser violated California’s Hazardous Waste Control Law, Medical Waste Management Act, Confidentiality of Medical Information Act, Customer Records Law and Unfair Competition Law, as well as HIPAA.
The practices also put California workers across industries at risk, Bonta said.
"The items found pose a serious risk to anyone who might come into contact with them from healthcare providers and patients in the same room as the trash cans to custodians and sanitation workers who directly handle the waste to workers at the landfill," Bonta said in a press conference on Friday.
As a healthcare provider that operates more than 700 facilities and treats more than 8.8 million Californians, Bonta added that Kaiser “should know that it has specific legal obligations to properly dispose of medical waste and safeguard patients’ medical information.”
Kaiser Permanente, based in Oakland, California, issued a statement taking full responsibility for the improper disposal practices and announcing it would cooperate fully with the California Attorney General and county district attorneys to correct how some facilities had disposed of medical and hazardous waste materials.
"About six years ago we became aware of occasions when, contrary to our rigorous policies and procedures, some facilities’ landfill-bound dumpsters included items that should have been disposed of differently,” the statement said.
Upon learning of the issue, Kaiser said, the organization began a three-pronged approach to address the problem, including improving training. All Kaiser Permanente staff and physicians in California are required to take waste disposal training annually, according to the statement. The company has also introduced new equipment, instructions and receptacles for medical waste.
Bonta noted Kaiser has been proactive thus far.
"I am pleased that Kaiser has been cooperative with my office and the district attorneys’ offices, and that it took immediate action to address the alleged violations,” he said in a statement to the press.
Kaiser has previously faced scrutiny for privacy concerns before.
The California Department of Justice filed a lawsuit against the company in 2014 alleging it delayed notifying its employees about an unencrypted USB drive that was discovered in a thrift store containing more than 20,000 employee records. Kaiser paid $150,000 in penalties and attorneys' fees for that offense.
