HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of June 15, 2018.
- Organization as reported
- New Jersey Department of Human Services, NJ
- Entity type as reported
- Health Plan
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Paper/Films
- Submission date
- June 15, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13781, row:4920)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), New Jersey Department of Human Services sent a file containing electronic protected health information (ePHI) to its business associate (BA) to generate and send out 1095B forms. In the course of preparing the file, the CE added individuals’ names and the last four digits of their social security numbers to the wrong 1095B forms, so that recipients of the mailing received ePHI for individuals who were not household members. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE ceased its responsibilities for mailing the 1095B forms for the New Jersey Department of Children and Families (DCF), Division of Child Protection and Permanency and changed procedures so that DCF will mail the 1095B forms from its own database. OCR obtained assurances that the CE implemented the corrective actions listed. Additionally, the CE is expected to conduct a risk analysis, implement a corresponding remediation plan, and ensure the implementation of policies and procedures relating to information system activity review, security incident response and reporting, access and audit controls, and creating/maintaining retrievable exact copies of ePHI.