Walgreens Faces $16.6 Million Penalty

The Walgreens drugstore chain will pay $16.6 million to settle a California case involving improper disposal of hazardous waste, as well as certain confidential patient information, in dumpsters near their stores.

See Also: Demonstrating HIPAA Compliance

Among the waste found by investigators were "90 different pieces of evidence" featuring patient records, including prescription receipts and pill bottles containing patient names, dates of birth, drug names, prescription record numbers, and other information, says Karen Doty, San Diego County deputy district attorney and head of the district attorney's environmental protection unit.

Alameda Superior Court ordered Walgreens to pay the monetary penalty as part of a settlement between the retailer and 42 California district attorneys and two city attorneys.

The judgment is the culmination of a civil enforcement lawsuit that contends that more than 600 Walgreens stores throughout the state unlawfully handled and disposed of hazardous waste for more than six years.

The monetary settlement did not break down what portion of financial penalty was tied to the improper disposal of confidential patient information, Doty explains.

Permanent Injunction

Before the settlement, the Alameda court also issued a permanent injunction "to prohibit future violations" of improper environmental waste and medical record disposal by Walgreens, Doty says.

"The California prosecutors' permanent injunction requires Walgreens to take all reasonable steps to destroy, or arrange for the destruction of, customers' records within its custody or control which contain confidential medical information that is no longer to be retained by the business in a manner that preserves the confidentiality," Doty says.

Although this case involved California-based Walgreen stores, its impact could be felt throughout the national chain, she says. "Our settlement makes Walgreen look at its environmental practices in all states, including what they do with customers' confidential information," she says.

Hazardous waste involved in the case included pesticides, bleach, paint, aerosols, automotive products and solvents, pharmaceutical and bio hazardous waste, and other toxic, ignitable and corrosive materials.

Making Changes

Walgreens said in a statement provided to HealthcareInfoSecurity that since 2007 the company has invested millions of dollars to develop and implement a comprehensive waste management program at all California stores to properly handle and dispose of discarded, damaged or expired consumer products that are covered by hazardous waste regulations in California.

"We also have worked with government officials throughout the state to initiate numerous significant enhancements such as automated waste classification and improved employee training. All hazardous materials are shipped by licensed environmental haulers to a hazardous waste disposal facility, where they are incinerated. We are continuing to strengthen our programs to ensure that these procedures are properly followed," the statement says.

"We did not admit to any wrongdoing, but like a number of other major retailers who faced similar questions in California, we agreed to settle this case to avoid the time and expense of protracted litigation. We are fully committed to continuing to improve our waste disposal practices."

There was no comment from Walgreens specifically regarding the company's disposal of waste containing patient information.

Other Settlements

California has entered similar hazardous waste settlements this year with other drug retailers, including Costco and CVS.

Also, in 2009, CVA Caremark agreed to pay $2.25 million to resolve a Department of Health and Human Services allegation that it violated HIPAA by improperly disposing of patient information on prescription pill bottles and other material in dumpsters.

Rite Aid settled a similar federal case in 2010, paying a $1 million penalty and agreeing to changes in processes and security audits (see: Rite Aid to Pay $1 Million in HIPAA Case).