HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Aug. 7, 2014.
- Organization as reported
- Jersey City Medical Center, NJ
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Aug. 7, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15026, row:6165)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Jersey City Medical Center, sent a package, via United Parcel Service (UPS) overnight service, that contained an unencrypted compact disk with the protected health information (PHI) of 36,400 patients. The package was not delivered to the intended recipient until three months later. The PHI included demographic, clinical, and health insurance information. The CE provided breach notification to HHS, the media, and the affected individuals (including the offer of 12 months of identity protection services at no cost to the affected individuals), and posted substitute notice on its website. Following the breach, the CE reminded workforce of the obligation to encrypt all outgoing PHI, sanctioned the two individuals responsible for creating the unencrypted CD, and provided HIPAA training to its workforce. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to conduct a risk analysis, and implement a corresponding remediation plan