Every year, regulators across the United States levy millions of dollars in fines against organizations that failed to properly dispose of sensitive documents. For New York businesses, the message from these cases is clear: the risk of improper document disposal is not hypothetical. It has happened to hospitals, pharmacies, financial institutions, real estate companies, and retailers — organizations that assumed their disposal practices were adequate, until a regulator demonstrated otherwise. Understanding the fines for improper document disposal, who paid them, and why provides the most compelling possible case for investing in a certified shredding program.
This article examines real enforcement actions and penalty amounts from the FTC, HHS Office for Civil Rights, state attorneys general, and financial regulators. These cases span multiple industries and involve organizations of all sizes — from solo medical practitioners to Fortune 500 companies.
Healthcare: HIPAA Enforcement for PHI Disposal Violations
The HHS Office for Civil Rights (OCR) is the primary enforcer of HIPAA’s Privacy and Security Rules, and improper disposal of Protected Health Information (PHI) is one of the most frequently cited violations in enforcement actions. The penalties under HIPAA range from $100 to $50,000 per violation, with annual caps up to $1.9 million per violation category.
Notable HIPAA disposal enforcement actions include:
- Parkview Health System (Indiana, 2014): $800,000 — Boxes of patient records were left unsecured outside a physician’s home, accessible to the public. OCR found a failure to implement proper safeguards for PHI disposal.
- Filefax, Inc. (Illinois, 2018): $100,000 — A medical records storage company left PHI in an unlocked truck in a parking lot and allowed unauthorized individuals to access records. The case involved improper handling throughout the disposal chain.
- Midwest Women’s Healthcare Specialists (Missouri): $10,000 civil penalty — Patient records found in unsecured location after practice closure, accessible to the general public.
- Large academic medical center (settled 2022): $300,000 — Improper disposal of paper PHI in regular dumpsters rather than through secure destruction services.
These cases involve organizations that knew about HIPAA but failed to implement compliant disposal procedures. Review our HIPAA compliance resources to ensure your practice is protected.
Financial Services: FTC and FACTA Disposal Rule Enforcement
The FTC’s FACTA Disposal Rule requires any entity that uses consumer reports to properly dispose of that information. This covers not just financial institutions but any employer who runs employee background checks, any landlord who screens tenants, and any business that pulls consumer credit data for any purpose. Violations can result in FTC civil penalties up to $2,500 per violation under the FTC Act.
Significant financial sector disposal enforcement actions include:
- American United Mortgage (FTC, multiple counts): Disposed of loan files containing consumers’ names, SSNs, credit scores, and financial histories in open dumpsters accessible to the public
- Gregory Navone (Nevada): $50,000 civil penalty — Real estate investor disposed of mortgage files in dumpsters visible and accessible from public areas
- Nations Title Agency (Ohio): $4,000 civil penalty per violation — Title company disposed of mortgage application files and loan documents in public trash without shredding
- Major bank (CFPB action, 2015): $2.5 million penalty — Improper disposal of mortgage servicing records that resulted in consumer harm
Our scheduled shredding services are specifically designed to meet FACTA Disposal Rule requirements for financial document destruction.
Retail and Commercial: FTC Enforcement for Consumer Data Disposal
Retailers and commercial businesses have also faced significant enforcement actions for improper disposal of customer data. The FTC has brought cases under both the FACTA Disposal Rule and Section 5 of the FTC Act (unfair or deceptive practices) against companies that failed to properly destroy consumer information.
Key commercial sector cases include:
- Dollar Financial Group: $2 million civil penalty — Disposed of consumer financial data in accessible dumpsters across multiple locations
- Goal Financial (student loan company): $2.5 million civil penalty — Discarded consumer information without shredding, exposing loan application data in public waste facilities
- CVS Caremark: $2.25 million settlement — Disposed of pharmacy labels with patient information and employee records in accessible dumpsters; the FTC and HHS jointly pursued the case
- Rite Aid: $1 million settlement — Disposed of pill bottles with patient identifiers in publicly accessible recycling containers at multiple pharmacy locations
The CVS and Rite Aid cases are particularly instructive because they show how the same disposal failure can trigger both FTC/FACTA enforcement AND HIPAA enforcement simultaneously, multiplying penalty exposure. Contact New York Shredding to implement a disposal program that protects against both.
State Attorney General Enforcement: New York and Beyond
Federal regulators are not the only enforcement risk. State attorneys general — including in New York — actively pursue document disposal violations under state privacy laws. New York’s SHIELD Act, enacted in 2020, specifically requires businesses to implement reasonable safeguards for disposing of private information, and the New York AG’s office has been aggressive in pursuing violations.
State-level enforcement examples include:
- New York AG: Multiple enforcement actions under SHIELD Act — Businesses that disposed of customer records in regular trash or recycling without shredding have faced investigation and settlement demands
- Massachusetts AG: $750,000 settlement — A data broker disposed of consumer records in public recycling bins accessible to the general public
- California AG: Multiple retail sector actions — Retailers who failed to shred customer credit card transaction records have faced civil penalties under California privacy law
Review our compliance page for information on New York-specific requirements that apply to your business.
The Pattern Behind These Penalties: What Went Wrong
Across all of these enforcement actions, a common pattern emerges. The violations that led to fines were almost universally caused by:
- No formal document disposal policy or procedure
- Documents placed in recycling bins, dumpsters, or trash without shredding
- Failure to train employees on proper disposal procedures
- Lack of oversight of third-party vendors who handled documents
- Documents left accessible to the public during moves, closures, or office transitions
In almost no case did organizations face penalties because their shredding vendor failed — the failures were upstream, at the level of deciding whether to shred at all. A simple, scheduled shredding program with locked consoles and a certified vendor would have prevented nearly every one of these enforcement actions. Request a quote to start your program today.
Why New York Businesses Choose New York Shredding
For over a decade, New York Shredding Document Destruction, Inc. has helped businesses across New York City, Long Island, Westchester, and the Hudson Valley protect their sensitive information through certified, HIPAA-compliant shredding services. Our industrial-grade shredding equipment, locked on-site consoles, and Certificate of Destruction give your business the proof it needs for any compliance audit.
Whether you need scheduled shredding, a one-time purge, or hard drive destruction, we serve all five boroughs and surrounding areas with fast, reliable service. Request a free quote today and get your office on a shredding schedule that keeps you protected year-round.
Ready to get started? Contact New York Shredding for a free quote, or explore our full range of shredding services. The cost of a shredding program is a fraction of the penalties documented in the cases above.