Ind. dentist pays $12K penalty for dumping patient files

An Indianapolis dentist has been sued by the state for HIPAA violations and will pay a $12,000 penalty. This is the first time Indiana has sued for a HIPAA violation.

The state attorney general's office sued former Kokomo-area dentist Joseph Beck, DDS, for mishandling medical records containing sensitive information of more than 5,600 patients.

In March 2013, Dr. Beck hired private company Just the Connection to retrieve and dispose of his patient records, which included names, medical records, phone numbers, birth dates, Social Security numbers, insurance cards, insurance information, and state identification numbers. The files contained records from 2002to 2007.

Less than a week later, 63 boxes of patient records were found in an Indianapolis dumpster. The attorney general's office recovered the files and fielded inquiries from individuals who were concerned that their records might be at risk. No identity theft was identified or reported.

"In an era when online data breaches are top of mind, we may forget that hard-copy paper files, especially in a medical context, can contain highly sensitive information that is ripe for identity theft or other crimes," said Attorney General Greg Zoeller. "This file dump was an egregious violation of patient privacy and safety."

In December 2011, the Indiana Board of Dentistry permanently revoked Dr. Beck's license to practice dentistry, following an investigation by the attorney general's office that cited fraudulent billing and negligence.