Jersey City Medical Center

The covered entity (CE), Jersey City Medical Center, sent a package, via United Parcel Service (UPS) overnight service, that contained an unencrypted compact disk with the protected health information (PHI) of 36,400 patients. The package was not delivered to the intended recipient until three months later. The PHI included demographic, clinical, and health insurance information. The CE provided breach notification to HHS, the media, and the affected individuals (including the offer of 12 months of identity protection services at no cost to the affected individuals), and posted substitute notice on its website. Following the breach, the CE reminded workforce of the obligation to encrypt all outgoing PHI, sanctioned the two individuals responsible for creating the unencrypted CD, and provided HIPAA training to its workforce. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to conduct a risk analysis, and implement a corresponding remediation plan