HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 22, 2013.
- Organization as reported
- New Jersey Department of Human Services, NJ
- Entity type as reported
- Health Plan
- Category as reported
Loss
- Location of information as reported
- Other Portable Electronic Device
- Submission date
- Nov. 22, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15257, row:6396)
- Archived copy
- Held in the private archive (provenance)
An employee of the covered entity's (CE) business associate (BA), Island Peer Review Organization, lost an unencrypted and not password-protected portable computer drive (a "USB" drive) that contained 9,825 patients’ names, addresses, dates of birth, social security numbers, clinical information, diagnoses, conditions, and identification numbers (including member identification, Medicaid identification, subscriber identification, patient account number and patient control number). The CE, New Jersey Department of Human Services, provided breach notification to HHS, and the BA notified affected individuals and the media. Following the breach, the BA recovered all of the USB drives used by employees and retrained these employees on the BA’s security policies and the appropriate use of encryption on portable electronic media. As a result of OCR’s investigation and technical assistance, the BA retrained certain staff and implemented a policy requiring staff to use only portable media purchased by the BA's Information Systems Department. The BA installed technical safeguards on all computers so only approved portable devices are allowed access while any other types can be rendered as “read only” or unusable. Further, the CE indicated that the BA's device access will be monitored and logged to guard against employees who attempt to copy data to unauthorized devices. OCR advised the CE of the requirements to perform a thorough and accurate risk analysis and establish a risk management plan.