What happens when paper isn't destroyed properly
These are real enforcement cases — hospitals, pharmacies, lenders and one-person businesses that put sensitive paper in the wrong place. None of them were hacked. Every one of them was a box, a bag, or a dumpster.
HIPAA
Medical and dental practices, pharmacies, and their vendors must destroy patient information so it can't be read or reconstructed. Fines run from tens of thousands to millions of dollars.
FACTA Disposal Rule
Any business that uses credit reports — lenders, landlords, dealers, employers — must take reasonable measures to protect that information when disposing of it. Enforced by the FTC.
Gramm-Leach-Bliley
Banks, credit unions, insurers, accountants and financial advisors are required to safeguard customer financial records through their entire life, including disposal.
Seven cases, one pattern
Click any case to see what happened, what it cost, and how on-site shredding would have prevented it.
A hospital system left 71 boxes of patient records in a drivewayParkview Health, Indiana · 2014$800,000
What happened
Parkview took custody of thousands of paper medical records from a retiring physician. Employees later left 71 cardboard boxes of those records — between 5,000 and 8,000 patients' worth — unattended in the driveway of the doctor's home, within reach of anyone walking by.
The lesson
Records don't have to end up in a dumpster to be a breach. The moment sensitive paper is somewhere unsecured — a driveway, a hallway, the back of a pickup — it counts. The federal Office for Civil Rights settled for $800,000.
Source: U.S. Department of Health & Human Services, Office for Civil Rights resolution agreement, 2014
How on-site shredding prevents this
Nothing sits around waiting. We destroy documents at your location, while you watch, in a single visit. There is no 'in between' where boxes wait unattended.
A records-storage company went out of business and left the files in a dumpsterFileFax Inc., Illinois · 2018$100,000
What happened
Doctors' offices paid FileFax to store their patient charts and shred them when the time came. Instead, a dumpster diver found hundreds of pounds of medical records outside the company's building and started selling the paper to a recycler. A local TV station investigated and found more records in a parked vehicle. The company was already defunct when regulators fined it $100,000 out of its remaining assets.
The lesson
Hiring someone doesn't transfer the responsibility. Regulators went after both the storage company and, in a related action, a pediatric practice that used it. If you're paying a vendor to protect records, you need proof they actually destroyed them.
Source: HHS Office for Civil Rights, 2018; HealthcareInfoSecurity reporting
How on-site shredding prevents this
You never hand us boxes to 'take care of later.' The shredding happens in front of you, and you receive a signed certificate of destruction for your records — the proof an auditor would ask for.
A one-location pharmacy tossed patient records in an open dumpsterCornell Prescription Pharmacy, Colorado · 2015$125,000
What happened
A single independent pharmacy disposed of documents containing patient names, prescriptions and other health information in an unlocked dumpster accessible to the public. A local news outlet found them. The pharmacy settled with federal regulators for $125,000 and had to overhaul its policies.
The lesson
Small businesses get fined too. Regulators specifically noted the size of the organization doesn't matter. For a one-location business, a six-figure penalty can be the difference between staying open and closing.
Source: HHS Office for Civil Rights resolution agreement, April 2015
How on-site shredding prevents this
A monthly or quarterly pickup with a locked bin in your office costs a fraction of one fine. Staff drop paper in the bin, and it's destroyed on-site on schedule.
Empty specimen jars with patient labels went in the regular trashNew England Dermatology & Laser Center, Massachusetts · 2022$300,640
What happened
The practice threw out empty specimen containers in a regular parking-lot dumpster. Each container still had a label with a patient's name, date of birth, and collection date. A third party found them. The exposure involved 58,106 patients and a $300,640 penalty plus a two-year corrective action plan.
The lesson
It doesn't have to be a whole file. A label, a sticky note, a shipping slip — if it identifies a person, it has to be destroyed properly. Regulators pointed to hiring a shredding contractor and keeping the certificate of destruction as the right way to do it.
Source: HHS Office for Civil Rights, August 2022
How on-site shredding prevents this
We shred labeled containers, ID bracelets, prescription labels and other odd items along with paper, so nothing identifiable goes in the regular trash.
A payday lender dumped loan applications and Social Security numbersPLS Financial Services, Illinois · 2012$101,500
What happened
The Federal Trade Commission charged two related lending companies with disposing of documents containing Social Security numbers, employment information, loan applications, bank account details and credit reports in unsecured dumpsters. They paid $101,500 and had to build an information security program from scratch.
The lesson
This isn't just a healthcare rule. Under the federal Disposal Rule (part of FACTA), any business that uses credit reports — lenders, landlords, car dealers, employers running background checks — must destroy them so they can't be read or reconstructed.
Source: Federal Trade Commission, October 2012; SHRM reporting
How on-site shredding prevents this
One scheduled visit clears the backlog and gives you documented proof of destruction. That documentation is exactly what 'reasonable measures' looks like to a regulator.
A mortgage broker threw 40 boxes of tax returns and credit reports in a public dumpsterIndividual mortgage broker, Nevada · 2010$35,000
What happened
After closing his mortgage companies, the owner disposed of about 40 boxes of customer files — tax returns, mortgage applications, bank statements, photocopies of credit cards and driver's licenses, and at least 230 credit reports — in a publicly accessible dumpster. The FTC fined him personally and required annual third-party security audits for ten years.
The lesson
Closing or selling a business doesn't end your responsibility for the records. Cleanouts are one of the riskiest moments for a company — and one of the easiest to get right.
Source: Federal Trade Commission press release, January 2010
How on-site shredding prevents this
Office and business closeouts are one of our core services. We come to the location, destroy everything in one pass, and you walk away with a certificate instead of a liability.
A billing company's old files turned up at the town dumpGoldthwait Associates, Massachusetts · 2013$140,000
What happened
The former owners of a medical billing practice disposed of records for roughly 67,000 patients at a public transfer station. Massachusetts' Attorney General fined the owners and four medical groups that had used them a combined $140,000.
The lesson
State attorneys general enforce disposal rules too, not only federal agencies. And clients of a careless vendor were fined alongside it.
Source: Massachusetts Attorney General's Office, January 2013
How on-site shredding prevents this
Ask any shredding vendor two questions: can I watch, and will I get a certificate? If the answer to either is no, keep looking.
What a professional shredding service should give you
Every case above shares a missing piece: no proof. Regulators repeatedly point to the same fix — hire a document destruction contractor and keep the certificate of destruction with your compliance records for at least six years.
Whoever you hire, ask for these four things. We provide all of them on every job.
The four-question test
- Can I watch it happen? On-site destruction means there's no gap between pickup and shredding.
- Will I get a certificate of destruction? Dated, signed, with the volume destroyed. It's your audit trail.
- Who actually handles my records? Ours are handled by the owner, Collin Lawrence — an Army intelligence veteran with an active clearance — not a rotating crew.
- What happens to the paper afterward? It should be baled and recycled, not left in an open container.
Don't be a case study.
One visit, one certificate, and the boxes in your closet stop being a liability.