Jupiter Family Medicine PC Data Breach Report

Incident Overview

Jupiter Family Medicine PC, a healthcare provider based in Michigan, experienced an unauthorized access and disclosure incident affecting approximately 3,000 patients. The breach was reported to the U.S. Department of Health and Human Services on June 5, 2025, and involved unauthorized access to patient records maintained in paper and film formats. This breach represents a significant privacy incident for the organization and its patient population, requiring immediate notification and remedial action under HIPAA Breach Notification Rule requirements.

Discovery and Response Timeline

The specific discovery date and investigation timeline have not been publicly detailed in available breach notification records. However, under HIPAA regulations, Jupiter Family Medicine PC was required to conduct a thorough investigation to determine the scope of the breach, identify affected individuals, and assess the risk of harm to patients. The organization's submission to HHS on June 5, 2025, indicates that the investigation and notification process was completed within the regulatory timeframe. Healthcare providers must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach. The organization likely implemented immediate containment measures to prevent further unauthorized access once the breach was identified.

Breach Mechanism and Details

Paper and Film Records Vulnerability

The breach involved unauthorized access to patient information stored in paper and film formats, which represents a distinct category of healthcare data security risk. Unlike digital breaches that typically involve network intrusions or malware, paper and film record breaches often result from physical security failures such as unlocked storage areas, inadequate access controls, theft of physical files, or improper disposal of records. The location designation of "Paper/Films" indicates that the compromised information was not stored in electronic health record (EHR) systems but rather in traditional physical storage formats commonly used in medical practices for historical records, imaging films, or paper-based documentation.

Physical records breaches may occur through several mechanisms: unauthorized personnel accessing restricted storage areas, theft of files by employees or external parties, loss of records during transport or storage transitions, or inadequate environmental controls in medical record rooms. The fact that no business associate was involved suggests the breach occurred within Jupiter Family Medicine PC's own facilities or under their direct control, rather than through a third-party vendor or service provider.

Organizational Context

Jupiter Family Medicine PC operates as a family medicine practice in Michigan, providing primary care services to the local community. Family medicine practices typically maintain comprehensive patient records spanning multiple years, including medical histories, diagnostic imaging films, laboratory results, and clinical documentation. The organization's size—serving approximately 3,000 affected patients—suggests a mid-sized practice with multiple providers and clinical staff. Michigan-based healthcare providers are subject to both HIPAA federal requirements and any applicable state privacy laws, which may impose additional notification or security obligations.

Patient Population Impact

Number of Individuals Affected

Approximately 3,000 patients had their protected health information (PHI) potentially exposed through this breach. This represents a substantial portion of a typical family medicine practice's patient roster and indicates a significant operational security failure. The affected population likely includes current patients, former patients, and potentially family members whose information may have been included in household medical records or emergency contact documentation.

Notification Requirements

Under the HIPAA Breach Notification Rule, Jupiter Family Medicine PC was required to provide written notification to each affected individual. The notification must include: (1) a description of the breach; (2) the types of information involved; (3) steps patients should take to protect themselves; (4) what the organization is doing to investigate and prevent future breaches; and (5) contact information for questions. Notifications must be provided in plain language and without unreasonable delay, typically within 60 days of breach discovery.

Likely Data Exposure

Given the paper and film format of the compromised records, the exposed information likely includes:

• Patient Demographics: Names, addresses, dates of birth, contact information
• Medical History: Diagnoses, treatment plans, medication lists, allergies
• Clinical Documentation: Progress notes, examination findings, clinical assessments
• Diagnostic Imaging: X-ray films, imaging reports, radiological findings
• Laboratory Results: Blood work, pathology reports, test results
• Insurance Information: Policy numbers, group numbers, subscriber information
• Social Security Numbers: Potentially included in older paper records or billing documentation
• Emergency Contact Information: Family member names and contact details

The sensitivity of this information is substantial, as it includes comprehensive medical and personal identifiers that could be used for identity theft, medical fraud, or unauthorized medical treatment.

HIPAA Compliance and Industry Context

This breach highlights ongoing vulnerabilities in physical healthcare record security. While much attention in healthcare cybersecurity focuses on digital systems and network security, paper and film records remain a significant source of HIPAA violations. The HIPAA Security Rule requires covered entities to implement administrative, physical, and technical safeguards to protect PHI, including physical access controls, facility security plans, and workstation security policies. Paper records must be stored in locked, secure areas with restricted access limited to authorized personnel with legitimate business needs.

According to HHS breach notification data, physical record breaches account for a meaningful percentage of healthcare data incidents, though they typically affect smaller numbers of individuals compared to large-scale network breaches. However, the sensitivity of information in physical records and the difficulty in determining exactly what was accessed make these incidents particularly concerning for patient privacy.

Recommended Patient Protections

Patients affected by this breach should implement comprehensive identity protection measures, including credit monitoring, fraud alerts, and regular review of medical records for unauthorized access or treatment.