http://www.govinfosecurity.com/800000-penalty-for-paper-records-breach-a-6982

Data breaches aren't anything new, but a fine of this magnitude related to
the mishandling of paper records is unusual, and maybe that explains why it
took 5 years for a verdict.

As someone who has stored and handled records for clients in the past that
contain both PHI and PFI, both of which are protected under the law, I know
there are requirements that must be met.  But with that said, there are
also ways around what happened here.

I had a client (a home builder) who would routinely request records for
delivery at the end of the day and it wasn't uncommon for them to close
prior to my arrival.  At first, I would leave a notice of an attempt of
delivery in their mail slot, then return the records to storage and wait
for a call the next day, re-deliver, and charge them for two deliveries and
one return trip.  I wasn't about to leave them in my vehicle and have them
damaged or stolen overnight, so they had to be taken back and put in queue
for a subsequent delivery.

After a few of these 3x charges to make one delivery, I gave them two
options.  One, any requests after 3pm would be delivered the following day.
Other option, they signed a release allowing me to leave them, unattended,
inside their lobby at their door.  I came up with a form for them to sign
in these cases, relieving me of any liability for exposure of information
contained in the files.

Larry
[log in to unmask]

-- 


*Lawrence J. Medina Danville, CARIM Professional since 1972*

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]