HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Jacobi Medical Center Reports 90,060 Patient Records Compromised

The New York City Health & Hospitals Corporation’s (HHC) Jacobi Medical Center has reported 90,060 patient records have been compromised when an employee copied the data from the company’s system and emailed it to her personal email account; as well as copying her new employer on the email.

The employee sent the information before leaving her employment at the HHC Jacobi Medical Center to work for another healthcare provider. The data contained detailed information about the patients which included their names, addresses, contact telephone numbers, medical record numbers, health insurance information, treatment dates and the category of services they received at the hospital. Some Social Security numbers were also present in the data.

However, the Medical Center’s quick response is believed to have prevented the data from being viewed by any other individual, although the possibility cannot be entirely eliminated. The Jacobi Medical Center’s data network is monitored automatically for communications sent containing Protected Health Information (PHI) and the incident was quickly discovered.

According to a statement issued by the hospital on April, 28, “PHI has been deleted from all known unauthorized sites and sources to which it was sent and there is no basis to believe that it was forwarded to any other site before it was deleted.”

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

Patients Advised to Take Steps to Protect Against Fraud

The risk to patients is perceived to be low; however it is important that patients take all data exposure seriously, even when there is only a small chance that information has been viewed by unauthorized individuals.

Insurance information, Social Security numbers and Personally Identifiable Information (PAA) was included in the exposed data; everything an identity thief needs to obtain loans and credit cards, make false insurance claims and commit medical fraud.

Because a risk does exist and the potential damage caused can be considerable, HHC is offering all affected patients free credit monitoring and identity protection services for a period of one year with ID Experts.

Breach Triggers Improvements to Data Security

HHC hospitals are protected by multi-layered cybersecurity systems and communications are monitored; however this security breach shows that no organization is immune, especially from insider theft. While the systems detected the breach, in this case they did not block the email from being sent.

The breach has highlighted this vulnerability in the HHC’s security defenses and action is being taken to address the issue. Patients have been informed that the organization is now setting up a new communication blocking system to prevent PHI from being sent to any third party or email account outside of the company’s intranet, except for authorized purposes.

A copy of the breach notice can be found here:

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.