In partnership with six district attorneys, on September 8, 2023, California Attorney General Rob Bonta announced a settlement with the largest healthcare provider in California. The settlement resolved allegations that the provider unlawfully disposed of hazardous waste, medical waste, and protected health information (PHI) at its facilities statewide. As part of the settlement, the provider will be liable for a total of $49 million and be required to take significant steps to prevent future unlawful disposals.
The settlement is the result of undercover inspections conducted by the district attorneys’ offices of dumpsters from 16 of the provider’s facilities. During those inspections, the district attorneys’ offices reviewed the contents of unsecured dumpsters destined for disposal at publicly accessible landfills, finding hundreds of items of hazardous and medical waste (aerosols, cleansers, sanitizers, batteries, electronic wastes, syringes, medical tubing with body fluids, and pharmaceuticals) and over 10,000 paper records containing the information of over 7,700 patients. The California Department of Justice subsequently joined the district attorneys and expanded the investigation of the provider’s disposal practices further throughout the state.
In response to this joint law enforcement investigation, the provider immediately hired a third-party consultant and conducted over 1,100 trash audits at its facilities in an effort to improve compliance. It also modified its operating procedures to improve its handling, storage, and disposal of waste.
As part of the settlement, the provider:
Will pay $47.250 million. That amount includes $37,513,000 in civil penalties, $4,832,000 in attorneys’ fees and costs, and $4,905,000 for supplemental environmental projects, primarily environmental prosecutor training.
Must pay an additional $1.75 million in civil penalties if, within 5 years of the entry of the final judgment, it has not spent $3.5 million at its California facilities to implement enhanced environmental compliance measures to ensure compliance with relevant provisions of the law that are alleged to have been violated.
Must retain an independent third-party auditor — approved by the Attorney General’s Office and the district attorneys — who will: perform no less than 520 trash compactor audits at the provider’s California facilities to help ensure that regulated wastes (including items containing PHI) are not unlawfully disposed of; and conduct at least 40 programmatic field audits each year, for a period of five years after entry of the final judgment, to evaluate the provider’s compliance with policies and procedures designed to ensure compliance with applicable laws related to hazardous waste, medical waste, and PHI.
The provider’s unlawful disposals are alleged to violate California’s Hazardous Waste Control Law, Medical Waste Management Act, Confidentiality of Medical Information Act, Customer Records Law, and Unfair Competition Law. The disposals are also alleged to violate the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA).
Compliance Perspective
Issue
Medical waste contains potentially harmful microorganisms that can infect residents/patients, healthcare workers, and the general public. Other potential hazards may include drug-resistant microorganisms which spread from healthcare facilities into the environment. Medical waste requires careful disposal and containment before collection and consolidation for treatment. The Occupational Safety and Health Administration (OSHA) has dictated initial measures for discarding regulated medical-waste items. The HIPAA Privacy Rule requires that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of PHI, in any form, including in connection with the disposal of such information. In general, a covered entity may not dispose of PHI in paper records, labeled prescription bottles, hospital identification bracelets, PHI on electronic media, or other forms of PHI in dumpsters, recycling bins, garbage cans, or other trash receptacles generally accessible by the public or other unauthorized persons. Failing to implement reasonable safeguards to protect PHI in connection with disposal could result in impermissible disclosures of PHI.
Discussion Points
- Review policies and procedures related to medical waste disposal and the proper disposal of PHI. Update as needed.
- Train appropriate staff on medical waste disposal. Train all staff on HIPAA and PHI upon hire, annually, and when any issues arise. Ensure that staff receive training on the disposal policies and procedures as necessary and appropriate for each member of staff. Any workforce member involved in disposing of PHI, or who supervises others who dispose of PHI, must receive training on disposal. This includes any volunteers. Document that these trainings occurred.
- Periodically audit to ensure medical waste is disposed of according to federal and state laws. Also periodically audit to ensure that appropriate disposal policies and procedures are in place to protect the privacy of medical records and other PHI, that they are consistently implemented, and that any identified issues are addressed timely and in full compliance with HIPAA requirements.
*This news alert has been prepared by Med-Net Concepts, LLC for informational purposes only and is not intended to provide legal advice.*
