Jersey City Medical Center

A workforce member of the covered entity (CE), Jersey City Medical Center, sent an email with a spreadsheet attachment that contained 1,447 patients’ protected health information (PHI) to an unintended recipient, who reported the disclosure to the CE within an hour of receiving the email. The spreadsheet included patients’ names, health insurance payors, dates of admission and discharges, department locations where medical services were received, and individuals’ account numbers. The CE provided breach notification to HHS, the media, and the affected individuals (including the offer of 12 months of identity protection services at no cost to the affected individuals), and posted notice to its website. Following the breach, the CE sanctioned and retrained the sender of the email, and provided HIPAA training to its workforce. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to complete certain remediation activities, conduct a risk analysis, and implement a corresponding remediation plan.