Rite Aid Settles FTC, HHS Charges That It Failed to Protect Medical and Financial Privacy of Customers and Employees
The Federal Trade Commission and Department of Health and Human Services have announced a settlement with Rite Aid concerning the privacy of the financial and medical data of its users.
The FTC began its investigation following news reports about Rite Aid pharmacies using open dumpsters to discard trash that contained consumers’ personal information such as pharmacy labels and job applications. At the same time, HHS began investigating the pharmacies’ disposal of health information protected by the Health Insurance Portability and Accountability Act (HIPAA).
This is the second case in which the FTC and HHS coordinated their investigations and settlements. The agencies resolved similar allegations with CVS Caremark in February 2009.
According to the FTC’s complaint, Rite Aid failed to use appropriate procedures in the following areas:
- disposing of personal information,
- adequately training employees,
- assessing compliance with its disposal policies and procedures, and
- employing a reasonable process for discovering and remedying risks to personal information. […]
The FTC settlement order requires Rite Aid to establish a comprehensive information security program designed to protect the security, confidentiality, and integrity of the personal information it collects from consumers and employees. It also requires the company to obtain,every two years for the next 20 years, an audit from a qualified, independent, third-party professional to ensure that its security program meets the standards of the order. In addition, the order bars future misrepresentations of the company’s security practices.
The HHS settlement requires Rite Aid pharmacies to establish policies and procedures for disposing of protected health information, create a training program for handling and disposing of patient information, conduct internal monitoring, and get an independent assessment of its compliance for three years. Rite Aid also will pay HHS $1 million to settle the matter. (http://www.hhs.gov/ocr/privacy/)