HHS’ Office for Civil Rights (“OCR”) recently announced a settlement with New England Dermatology and Laser Center related to the improper disposal of protected health information. On May 11, 2021, the practice submitted a breach notification report to OCR, disclosing that the practice had disposed of empty labeled specimen containers in the garbage bin in its parking lot. The specimen container labels included patient names, dates of birth, dates of specimen collection, and provider names. An investigation by OCR found two potential violations of the HIPAA Privacy Rule: impermissible disclosure of PHI and failure to maintain appropriate safeguards to protect PHI privacy. The practice agreed to pay $300,640, and implement a corrective action plan with a two-year compliance term.