September 1, 2026
This story is fictional. If it sounds like your pharmacy, that’s between you and your privacy officer.
“Where’s the bag?”
“Which bag?”
“The black one by the back door. The heavy one.”
David brightened, the way he does when he has anticipated a need. David is the best technician I have ever worked with, and I want that on the record before the rest of this. “Oh, that one. I put it in the trash.”
“With the labels still on?”
“They were just empties.”
“With the labels still on?”
“It’s Tuesday,” he said, as if that settled it. “Truck comes at ten. I figured I’d save you a trip out to the dumpster.”
As if he had summoned it, from beyond the cinderblock wall came the hydraulic groan of our dumpster going up and over, and the boom of its contents landing in the hopper. We went out the back at a run, David a step behind me and still, I think, not entirely sure why. The truck was already making a hard left onto Pine Street, rumbling toward the interstate, which in our part of the metro is four minutes from the state line.
When a filled prescription sits in will-call too long, we pour the pills back into stock and keep the labeled vial for the shred bin. A quarter’s worth of those vials had been in that bag, each with a patient’s name, the drug, the dose, the prescriber and a phone number.
David asked whether he should go after the truck. I told him to go inside and pull the reversal report.
Before you read on: Is this a breach? If so, does the pharmacy owe a press release, a report to the federal government, or both?
A label with a name and a drug on it is protected health information, and pharmacies have paid OCR before for leaving labeled bottles in dumpsters: CVS in 2009 and Rite Aid in 2010, under the safeguards requirement in 45 C.F.R. § 164.530(c). Under § 164.402 the loss is presumed to be a breach unless a documented risk assessment shows a low probability that the information was compromised. The compactor helps that argument, but they could not recover the bag or cannot know whether anyone opened it before ten o’clock; the pharmacy carries the burden of proof (§ 164.414(b)). It is a breach, and the 60-day clock started Tuesday morning (§ 164.404(a)(2)).
The reversal report is used to rebuild what was in the bag: 612 vials. The breach rules count people, and many patients had more than one vial in the bag. After de-duplication the number is 517, with 374 living in Kansas and 143 across the line in Missouri.
Those numbers matter for the two thresholds that are easy to confuse. Media notice under § 164.406 applies when a breach involves more than 500 residents of a State or jurisdiction. Neither state reaches 500, so the pharmacy owes no press release. Notice to the Secretary under § 164.408(b) applies when a breach involves 500 or more individuals in total. At 517 this breach qualifies, and the report is due when the letters to patients go out under § 164.404. Breaches of that size are listed on OCR’s public breach portal, which reporters check, so the story can still reach the news. Both states’ breach statutes need checking too.
Do the count before anyone decides about notice. Count individuals rather than vials or records, sort them by state of residence, and test each threshold against the number it asks for: residents of one state for the media rule, the total for the Secretary. A pharmacy that stops at “612 bottles” sends a press release it need to. One that stops at “under 500 in each state” misses the Secretary’s deadline.
Takeaway: Count people, not bottles, and check each threshold. Better still, check the bags for PHI before trash day.