In a series of recent enforcement actions, HHS has required HIPAA covered entities (which include group health plans) to make sizeable payments and satisfy rigorous corrective action plans to settle potential privacy and security violations. Some of these enforcement actions have resulted from covered entities' failures to appropriately dispose of protected health information (PHI), highlighting the need for adequate policies and procedures to protect PHI during the disposal process.

For a discussion of the HIPAA guidelines for disposing of PHI, see Practice Note, Disposing of Protected Health Information under HIPAA.