Forgiveness means never having to say you're not insured.

arious types of insurance are vital to the healthcare industry to protect institutions, physicians, and patients. But what is the appropriate type of insurance to indemnify data destruction providers? This article will explain a misconception about insurance that may be putting both HIM professionals and their clients at risk. For decades there have been questions about the proper type of insurance to cover record destruction services. If material surfaces (like protected health information) after it was entrusted to the shredding contractor, how will the contractor cover the possible resulting financial loss to the client? It wasn’t until recently that the industry’s 10-year-old trade organization, the National Association for Information Destruction (NAID), began to investigate the issue. Why is now the time for action? What motivated these changes? Simply put, privacy legislation like HIPAA and the Gramm-Leach-Bliley Act of 1999 (GLB) were enacted. GLB is the equivalent of HIPAA to the financial sector and requires notification of privacy policies and the ability to opt out. In addition, mounting consumer concerns over identity theft and privacy contributed to the call for action. Risk managers and compliance officers at medical and financial institutions began specifying in business associate agreements that shredding contractors accept the liability for potential damages resulting from their non-performance (i.e., unauthorized release of protected health information) whether by accident or negligence. Such indemnification became much more important as information disposal became recognized as a significant source of exposure. Maintaining Bonds Historically, bonding–or more specifically, employee dishonesty bonding–was obtained by shredding companies in an effort to show some type of coverage. Bonding was often obtained more by default, since service providers were unsure of how to indemnify themselves and their clients. Unfortunately, “employee bonding” has no real value as any form of liability indemnification for financial damages suffered by the client from the negligence or accident on the part of the document destruction company. It covers a client if a contractor’s employee stole money, a computer, or some furniture, but it is not meant to cover damages resulting from the unauthorized release of information.