"A recent Resolution Agreement and Corrective Action Plan between a stand-alone pharmacy and the [HHS] Office for Civil Rights (OCR) highlights the ongoing importance of secure disposal of paper medical records. HIPAA covered entities and business associates of every size should be aware that disposal of hard-copy media, including paper and film, remains a legitimate privacy and security concern, and merits ongoing vigilance even as businesses hone their e-PHI practices.... OCR investigations and enforcement actions involving the disposal of paper records highlight the particular vulnerabilities of hard-copy media: covered entities, business associates, and workforce members may be less attuned to or focused on appropriate disposal procedures (because it looks like ordinary trash, it may inadvertently be treated like ordinary trash), and there is no equivalent to encryption for paper records 'at rest' or 'in motion.' "