Regulators may launch investigations into prescription privacy

Published: .
Updated: .

Bob Segall/13 Investigates

State and federal regulators say they have been watching WTHR's prescription privacy investigation and might launch their own investigations following the reports.

13 Investigates found healthcare information about hundreds of Hoosiers in the dumpsters behind local drug stores.

"Those are confidential medical records that need to be protected," said Frances Kelly, executive director of the Indiana Professional Licensing Agency, which grants licenses to the state's pharmacies.

Kelly said the state's pharmacy inspectors are "concerned and quite surprised" to see the results of WTHR's investigation, and that inspectors will now be conducting more thorough pharmacy inspections to make sure drug stores are well equipped to properly dispose of customers' personal health information.

Indiana Administrative Code requires that "information regarding individual patients shall be maintained in a manner to assure confidentiality of the patient's record." Kelly says that appears not be happening at many of the pharmacies featured in the prescription privacy investigation. "This should be a wakeup call that they need to be a little more careful with patient records," she added.

Kelly says her agency will work with the Indiana Attorney General's office to review any alleged violations of state law. The attorney general's office investigates reported incidents involving privacy violations of the state pharmacy code. Complaints can be filed through the Attorney General's office or through the State Licensing Agency and, if validated, can result in discipline or fines against a pharmacy, a pharmacist or both.

In Washington, D.C., officials at the Department of Health and Human Services have been "closely monitoring" the investigation, as well.

"I can tell you there are people in the highest levels of OCR who are watching these reports and are very interested in what they are seeing," said DHHS spokesman Patrick Hadley. OCR is the department's Office of Civil Rights, which investigates violations of the federal health privacy law known as HIPAA.

Last week, several local families filed HIPAA complaints with the OCR's regional office in Chicago after they learned their personal information was found in dumpsters during WTHR's pharmacy investigation. That clears the way for OCR to begin its own investigation, although the agency will not confirm whether that has happened.

"We take complaints very seriously," said Susan McAndrew, senior advisor for HIPAA privacy policy at the Department of Health and Human Services. "Just tossing out patient's personal information where anyone can access it is not taking reasonable precautions."