Otolaryngology Associates of Central New Jersey

Law enforcement notified the covered entity (CE) about an unauthorized removal of thirteen boxes of former patients’ paper medical records from a locked, off-site storage facility. The thirteen boxes contained 1,551 patients’ names, addresses, telephone numbers, health plan account numbers, dates of births, dates of services, treating physicians, social security numbers, and driver’s license numbers. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE cooperated with law enforcement in the prosecution of the individual who removed the boxes and sanctioned the staff member who was related to the apprehended individual. In addition, the CE switched to another secure facility to store its paper medical records, adopted new HIPAA policies and procedures, and re-trained all staff. OCR obtained assurances that the CE implemented the corrective actions listed.