Jamaica Hospital Medical Center

Jamaica Hospital Medical Center, the covered entity (CE), reported a breach occurring from August 1, 2011 through March 27, 2014, resulting from five employees impermissibly accessing the protected health information (PHI) of 26,162 patients who had been seen in the CE’s Emergency Department. The PHI included patient names, addresses, dates of birth, Social Security Numbers, diagnoses, insurance information, age, sex, telephone number and dates of admission. The five employees disclosed the PHI to third parties for solicitation purposes. The CE provided breach notification to HHS, the media, and the affected individuals, and posted notice to its website. Following the breach, the CE terminated the five employees and redesigned work flows to allow for greater oversight of employees. OCR provided technical assistance to the CE on corrective action needed to demonstrate the CE’s compliance. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to conduct a comprehensive and thorough risk analysis, implement a corresponding remediation plan, and implement improvements to its processes regarding information system activity review and information access management.