Rite Aid to pay $1 million for privacy violations

The Rite Aid drug store chain has agreed to pay $1 million to settle potential violations of federal medical privacy laws, the Department of Health and Human Services announced Tuesday.

The settlement follows an investigation by HHS' Office for Civil Rights (OCR) and the Federal Trade Commission sparked by television reports that Rite Aid pharmacies across the country were dumping prescriptions and pill bottles with personal identification still visible. The settlement also requires Rite Aid to improve policies and procedures to safeguard the privacy of its customers at its almost 4,800 retail pharmacies.

"It is critical that companies, large and small, build a culture of compliance to protect consumers' right to privacy and safeguard health information..." Georgina Verdugo, director of OCR, said in a statement. "We hope that this agreement will spur other health organizations to examine and improve their policies and procedures for protecting patient information during the disposal process."

The corrective action program includes:

• Revising and distributing policies and procedures regarding disposal of protected health information and sanctioning workers who do not follow them;

• training employees on these new requirements;

• conducting internal monitoring; and

• engaging a qualified, independent third-party assessor to conduct compliance reviews and render reports to HHS. 

Rite Aid has also agreed to external, independent assessments of its pharmacy stores' compliance with an FTC consent order. The HHS corrective action plan will be in place for three years; the FTC order will be in place for 20 years.