Updated November 2026 · Southern New Hampshire
Improper document disposal fines: real HHS and FTC cases and what they cost
Improper document disposal fines are not a theory. Below are nine real federal cases, from a pharmacy chain that paid $2.25 million to a mortgage broker who paid $35,000, each cited to the agency that brought it, with what went wrong and what it cost.
Ten boxes shredded for $234.90 at our Tewksbury drop-off. Certificate of Destruction on every job.
- $234.90 for 10 boxes
- HIPAA BAA on request
- Since 2007
- BBB A+
Quick answer
Federal improper document disposal cases have cost businesses from $35,000 to $2.25 million. HHS settled with CVS Pharmacy for $2.25 million in 2009 and with Parkview Health System for $800,000 in 2014 over paper records left where the public could reach them, and the FTC’s first Disposal Rule case ended in a $50,000 civil penalty in 2007. Today’s HIPAA penalty table allows up to $2,190,294 a year for identical violations, while New Hampshire Document Shredding shreds 10 banker’s boxes for $234.90 with a certificate, as part of its document shredding service.
Improper document disposal fines follow the same pattern
Read enough of these cases and they start to sound alike. Nobody set out to leak anything. Paper that should have been shredded ended up somewhere the public could reach it, and someone noticed: a TV crew, a security guard, a retiring doctor, an anonymous caller.
That is good news for you. The failures are ordinary, so the fixes are ordinary too. Every case below comes from an official HHS or FTC page or an official press release, and we have left out any case we could not confirm on one.
The open dumpster
Prescription labels, loan files and credit reports thrown into trash containers anyone could open. The single most common setting in these cases.
The unattended stack
Boxes of records left on a driveway or in an open container on the premises, waiting for someone to deal with them.
The open vehicle
Records sitting in a truck that was not locked in a parking lot, or handed to someone with no right to them, who then sold them.
No written policy
Investigators asked for the disposal policy and the training records. In several cases there were none.
No sanctions
Staff who skipped the disposal rules faced no consequence, so the rules were optional in practice.
Labels forgotten
Not only files. Pill bottle labels and specimen containers with patient names count as protected information too.
HHS cases: paper health records in the wrong place
The HHS Office for Civil Rights enforces HIPAA. When it finds a problem it usually settles through a resolution agreement: a payment plus a corrective action plan. These are the paper disposal cases it lists on its resolution agreements page.
| Announced | Organization | What happened | Paid |
|---|---|---|---|
| Jan 16, 2009 | CVS Pharmacy | Media reports of pharmacies discarding patient information, such as prescription labels and old prescriptions, in dumpsters the public could access | $2,250,000 |
| Jul 27, 2010 | Rite Aid | TV crews filmed pharmacies throwing prescriptions and labeled pill bottles into industrial trash containers accessible to the public | $1,000,000 |
| Jun 23, 2014 | Parkview Health System | 71 boxes of a retiring physician’s patient records left on her driveway, within 20 feet of a public road | $800,000 |
| Apr 22, 2015 | Cornell Prescription Pharmacy | Unshredded documents with the PHI of 1,610 patients in an open container on the premises that was not locked | $125,000 |
| Feb 13, 2018 | Filefax (paid by its receiver) | Records of about 2,150 patients left unsecured and taken to a shredding and recycling facility to be sold | $100,000 |
| Aug 23, 2022 | New England Dermatology and Laser Center | Empty specimen containers labeled with PHI thrown out as regular trash in a parking lot dumpster | $300,640 |
CVS was the first. OCR opened its investigation after media reports about several pharmacy chains, and found CVS had not put adequate disposal policies in place, had not trained employees on them, and had no sanctions policy for workers who ignored them. The $2.25 million came with a corrective action plan covering all of its more than 6,300 stores, and CVS Caremark signed a separate consent order with the FTC.
Rite Aid followed in 2010, after TV crews filmed pharmacies in several cities throwing prescriptions and labeled pill bottles into industrial trash containers. Rite Aid and its 40 affiliated entities paid HHS $1 million, and the corrective action covered nearly 4,800 pharmacies. HHS described it as the second joint investigation and settlement with the FTC.
The Parkview case shows how small the mistake can be. According to the HHS press release, Parkview took custody of records for about 5,000 to 8,000 patients while helping a retiring physician move them to new providers. On June 4, 2009, employees who knew she was not home left 71 cardboard boxes of those records on her driveway, a short distance from a busy shopping area. The settlement was $800,000.
Size does not protect anyone either. Cornell Prescription Pharmacy was a single-location pharmacy in the Denver area. A local news outlet tipped off OCR about unshredded documents with the information of 1,610 patients in an open container. OCR found no written disposal policies and no training. It paid $125,000.
The most recent case involves something most offices never think of as a document. New England Dermatology and Laser Center told OCR it had thrown out empty specimen containers bearing patient labels, with names, dates of birth and collection dates, as regular trash from February 4, 2011 until March 31, 2021. A security guard found one in the parking lot. The resolution amount was $300,640.
What improper document disposal fines cost, side by side
Put the numbers on one chart and two things stand out. The HIPAA settlements dwarf the FTC civil penalties, and even the smallest amount here would pay for hundreds of shredding jobs.
The comparison is not subtle. Cornell’s $125,000 settlement would cover more than 530 ten-box drop-off jobs at our Tewksbury office. The Parkview settlement alone would cover more than 3,400. And the money is only the first bill. Every one of these organizations also had to rewrite its policies, retrain its staff and report back to a federal agency for years.
FTC Disposal Rule cases: credit reports in dumpsters
The FTC’s Disposal Rule, 16 CFR Part 682, covers anyone who uses consumer report information for a business purpose: lenders, landlords, employers, insurers and debt collectors among them. It says to dispose of that information with reasonable measures, and its main example is burning, pulverizing or shredding paper so it cannot practicably be read or reconstructed.
| Announced | Defendant | What happened | Civil penalty |
|---|---|---|---|
| Dec 18, 2007 | American United Mortgage Company, Northbrook, Illinois | Loan documents with sensitive consumer data left in and around an unsecured dumpster near its office. The FTC’s first Disposal Rule case | $50,000 |
| Jan 20, 2010 | Gregory Navone, Las Vegas mortgage broker | About 40 boxes of records, including at least 230 credit reports, tax returns and bank statements, in a publicly accessible dumpster | $35,000 |
| Nov 7, 2012 | PLS Financial Services and The Payday Loan Store of Illinois | Documents with Social Security numbers, loan applications, bank account information and credit reports in unsecured dumpsters near several stores | $101,500 |
These amounts look modest next to the HIPAA settlements. The orders attached to them do not. American United Mortgage had to get an independent security audit every two years for ten years. Navone’s information security program had to be reviewed by an independent professional every year for ten years. The payday lenders agreed to independent third-party audits every other year for twenty years.
For a New Hampshire landlord who pulls tenant credit, an insurer, or an employer that runs background checks, this is the rule that applies. Our post on the FACTA disposal rule explains who it covers and what a reasonable disposal program looks like.
Beyond the check: what the orders required
A settlement amount makes the headline. The corrective action plan is what an office actually lives with afterward. Across these cases the requirements repeat, and they read like a checklist of what the organizations should have had in the first place.
- Written disposal policies and procedures, revised and handed to every worker
- Training for every workforce member who handles or supervises disposal
- A sanctions policy for staff who do not follow the rules
- Internal monitoring and, in the larger cases, an outside assessor reporting to HHS
- Independent security audits for 10 or 20 years under FTC orders
- Reports to the agency for the life of the plan
The FTC orders against CVS Caremark and Rite Aid each required an audit by a qualified independent professional every two years for 20 years. The HHS plan for Rite Aid ran three years. For Filefax, which had already closed, the receiver agreed to store and dispose of the remaining records properly, because HIPAA still applied after the doors shut.
OCR’s director put the basic duty plainly when the Cornell case was announced: regardless of size, organizations cannot abandon protected health information or dispose of it in dumpsters or other containers the public or other unauthorized people can reach. Our post on HIPAA shredding requirements turns that duty into a checklist for a practice.
What regulators can charge today
The cases above were negotiated settlements. The law also sets penalty ranges, and HHS and the FTC adjust them for inflation. These are the current figures published in the Code of Federal Regulations.
| Rule and tier | Per violation | Yearly cap, identical violations |
|---|---|---|
| HIPAA: did not know and could not reasonably have known | $145 to $73,011 | $2,190,294 |
| HIPAA: reasonable cause, not willful neglect | $1,461 to $73,011 | $2,190,294 |
| HIPAA: willful neglect, corrected within 30 days | $14,602 to $73,011 | $2,190,294 |
| HIPAA: willful neglect, not corrected | $73,011 to $2,190,294 | $2,190,294 |
| Fair Credit Reporting Act civil penalty, 15 U.S.C. 1681s(a)(2) | Up to $4,983 | Not stated in 16 CFR 1.98 |
The HIPAA figures are the 2025 adjusted amounts in the HHS table at 45 CFR 102.3, which implements the tiers in 45 CFR 160.404. The FCRA figure is the FTC’s January 2025 adjustment at 16 CFR 1.98(m).
New Hampshire adds a notice duty. RSA 359-C:20 requires a business that owns or licenses computerized personal information to look into a security breach and notify affected individuals when misuse has occurred, is reasonably likely, or cannot be ruled out. Paper records sit mostly under the federal rules above. Our post on New Hampshire data breach law covers the state side in detail.
Five habits that keep you out of these cases
Every failure above maps to a habit you can build in an afternoon. None of them requires new software or a consultant. They require paper to stay locked from the moment it is discarded until it is destroyed, and a record that proves it.
The flow below is the one we see work in small New Hampshire offices. It starts at the desk and ends in your compliance binder.
- Lock the bin. Discarded paper goes into a locked console or a locked closet, never an open box under the printer or a recycling bin by the copier.
- Keep waiting boxes inside. Sealed boxes stay in a locked room until the pickup or the drive to Tewksbury. Not the hallway, the loading dock or someone’s car.
- Put the vendor under contract. If you are a HIPAA covered entity, the company that destroys your patient paper should sign a Business Associate Agreement. We sign one on request.
- Write it down and train on it. A one-page disposal policy, a training record for each person who handles it, and a stated consequence for skipping it. Investigators found gaps in all three at CVS and Rite Aid, and Cornell had no written policies or training at all.
- File the proof. Keep the Certificate of Destruction for each job with your policy. Our page on the certificate of destruction explains what it shows and how long to keep it.
Then pick the service that fits your volume. Under 10 boxes, drop off at 99 cents a pound. At 10 or more, pay $20 per banker’s box, and book our off-site shredding pickup if no one can make the drive. Every job adds $34.90 in per-job fees, and the full list is on our shredding rates page. Old drives and phones go in a separate bag for our hard drive destruction service, quoted per item.
Frequently asked questions
What is the largest improper document disposal fine?
Among the paper disposal cases HHS lists, CVS Pharmacy’s 2009 settlement of $2.25 million is the largest. OCR found CVS lacked adequate disposal policies, training and sanctions after media reports of patient information in unsecured dumpsters. The settlement included a corrective action plan for more than 6,300 stores.
Can a small office really be fined for throwing out records?
Yes. Cornell Prescription Pharmacy was a single-location pharmacy and paid $125,000 in 2015 over unshredded patient documents in an open container. Gregory Navone, a Las Vegas mortgage broker, paid a $35,000 civil penalty over boxes of records in a dumpster. Size did not matter in either case.
What is the FTC Disposal Rule penalty today?
The FTC’s inflation adjustment at 16 CFR 1.98(m) sets the Fair Credit Reporting Act civil penalty at up to $4,983 per violation, as adjusted in January 2025. Past Disposal Rule cases also came with long orders, including outside security audits every other year for 20 years.
What are the HIPAA penalty tiers?
Under 45 CFR 160.404 and the 2025 figures in 45 CFR 102.3, the per-violation range runs from $145 when an entity could not have known, up to $73,011 to $2,190,294 for willful neglect that is not corrected. Identical violations are capped at $2,190,294 a calendar year.
Does putting records in a recycling bin count as disposal?
Not safe disposal. OCR has said organizations cannot abandon protected health information or dispose of it in dumpsters or other containers the public or unauthorized people can reach. The FTC rule asks for paper to be burned, pulverized or shredded so it cannot practicably be read. A recycling bin does neither.
Are labels and containers covered, or only paper files?
Labels count. CVS and Rite Aid involved labeled pill bottles. New England Dermatology and Laser Center paid $300,640 after throwing out specimen containers labeled with patient names and dates of birth. If an item carries patient or customer information, it needs secure disposal.
Does closing a business end the obligation?
No. Filefax, an Illinois medical records company, shut down during an OCR investigation. Its court-appointed receiver still paid $100,000 and agreed to store and dispose of the remaining records properly. HHS titled the announcement “Consequences for HIPAA violations don’t stop when a business closes.”
How do I prove my office disposed of records properly?
Keep a written disposal policy, training records, a signed Business Associate Agreement with your vendor if you are a HIPAA covered entity, and a Certificate of Destruction for every job. We include the certificate with every job, covered by the $14.95 HIPAA filing fee in our $34.90 per-job fees.
Sources
- HHS Office for Civil Rights, Resolution Agreements (list with dates) (checked November 2026)
- HHS, CVS Pays $2.25 Million and Toughens Disposal Practices (checked November 2026)
- FTC, Rite Aid Settles FTC Charges (July 27, 2010) (checked November 2026)
- HHS press release, $800,000 HIPAA settlement in medical records dumping case (Parkview) (checked November 2026)
- HHS, HIPAA Settlement Highlights the Continuing Importance of Secure Disposal of Paper Medical Records (Cornell) (checked November 2026)
- HHS press release, Consequences for HIPAA violations don’t stop when a business closes (Filefax) (checked November 2026)
- HHS, New England Dermatology Resolution Agreement and Corrective Action Plan (checked November 2026)
- FTC, Company Will Pay $50,000 Penalty for Tossing Consumers’ Credit Report Information in Unsecured Dumpster (checked November 2026)
- FTC, Mortgage Broker Who Dumped Consumer Records Settles FTC Charges (Navone) (checked November 2026)
- FTC, Payday Lending and Check Cashing Companies Settle FTC Charges They Tossed Sensitive Consumer Data into Dumpsters (PLS) (checked November 2026)
Shred it before it becomes a case
Drop off at our Tewksbury office, book a pickup by zone, or watch it happen in a witnessed session. Every job comes with a Certificate of Destruction, and we sign a BAA on request.
Where we shred
1215 Main Street, Unit 115, Tewksbury, MA 01876. Route 38, near I-495. Free parking out front.
Monday to Friday, 10 a.m. to 5 p.m. Witnessed sessions and pickups outside these hours by appointment.
- Drop-off: walk in, 99¢ per pound
- Pickup: from $129.95 by zone
- Witnessed: $1.99 per pound, $100 minimum
New Hampshire Document Shredding · 1215 Main Street, Unit 115, Tewksbury, MA 01876 · (978) 636-0301 · Monday to Friday, 10 a.m. to 5 p.m.