HIPAA sets the national standard for protecting patient health information. Its Privacy Rule and Security Rule govern how "protected health information" (PHI) is used, stored, transmitted and, critically, disposed of.

Who it applies to

• Doctors, dentists, chiropractors, therapists and clinics
• Hospitals, nursing homes and home-health agencies
• Pharmacies and labs
• Health insurers and billing companies
• Any vendor that handles PHI on their behalf (a "business associate" — see HITECH)

What counts as PHI on paper

More than charts. Appointment schedules, prescription labels, specimen containers, insurance explanations of benefits, ID bracelets, billing statements and sign-in sheets all contain PHI if they connect a name to a health detail. The dermatology practice in our case studies was fined $300,640 over labels on empty specimen jars.

What it requires for disposal

The Department of Health and Human Services says covered entities may not dispose of PHI in dumpsters, recycling bins or trash cans accessible to the public. Its guidance names the acceptable methods for paper: shredding, burning, pulping or pulverizing, so the information cannot be read or reconstructed. HHS also expects you to keep documentation of your policies and disposal practices for six years.

What non-compliance costs

HHS's Office for Civil Rights issues civil penalties in tiers based on how much the organization knew, currently ranging from a few hundred dollars per violation to over $2 million per year for the same provision (amounts are adjusted for inflation). Settlements almost always add a corrective action plan with years of federal oversight. Knowing violations can be prosecuted criminally.

This page is a plain-English summary for business owners, not legal advice. Talk to your attorney or compliance officer about how the law applies to you.