HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Nov. 2, 2018.
- Organization as reported
- Summit Medical Group, NJ
- Entity type as reported
- Healthcare Provider
- Category as reported
Loss
- Location of information as reported
- Paper/Films
- Submission date
- Nov. 2, 2018
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13641, row:4780)
- Archived copy
- Held in the private archive (provenance)
A staff member misplaced and was unable to recover a handwritten notebook in which the staff member maintained protected health information (PHI) for approximately 525 patients. The types of PHI included patients’ names, dates of births, addresses, social security numbers, telephone numbers, medical records numbers, health plan information, clinical information and dates of services. The CE provided breach notification to HHS, affected individuals and the media. Following the breach, the CE re-trained all staff regarding safeguarding PHI and advised staff that personal maintenance of patient information outside the covered entity’s electronic health record (EHR) system was prohibited, unless approved by management. In addition, the CE sanctioned the staff member and reprimanded the staff member’s manager. OCR obtained assurances that the CE implemented the corrective actions listed.