HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Sept. 22, 2016.
- Organization as reported
- New Jersey Spine Center, NJ
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Electronic Medical Record, Network Server
- Submission date
- Sept. 22, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14416, row:5555)
- Archived copy
- Held in the private archive (provenance)
The covered entity’s (CE) computer system was attacked by a ransomware virus that encrypted files, including the electronic protected health information (ePHI) of approximately 28,000 patients and damaged the network operating system rendering all of the CE's files unusable. The ePHI included demographic and clinical information. The CE provided breach notification to HHS, affected individuals, and the media and provided free credit monitoring to affected individuals. Following the breach, the CE deactivated the username and password that the hacker used to break into its system. The CE provided OCR with copies of its HIPAA policies and procedures and assurances that staff was trained on the HIPAA Privacy and Security Rules. OCR obtained assurances that the CE implemented the corrective actions listed. The CE is expected to conduct a risk analysis and implement a corresponding remediation plan, review its existing HIPAA policies and procedures, execute a new business associate agreement with its electronic health records vendor, and conduct an assessment on applications to determine how important each is to patient care or business needs, in order to prioritize for data backup, disaster recovery and/or emergency operations plans.