State of New Jersey Department of Human Services, Division of Medical Assistance and Health Services

Data Breach at New Jersey Department of Human Services

The New Jersey Department of Human Services (NJDHS), Division of Medical Assistance and Health Services (DMAHS), experienced a data breach that affected some NJ FamilyCare clients. The breach involved the names and the last four digits of Social Security numbers of individuals. Specifically, on or after April 11, the DMAHS mailed out 1095B tax forms to confirm health coverage from NJ FamilyCare to the head of the household, which included the names and last four digits of the Social Security numbers of all dependents in the household. On or after April 18, it was discovered that forms mailed to 842 households mistakenly included the names and last four digits of a client’s Social Security number for individuals who are not part of that household. No other personal information was included in the breach. The Division commenced an investigation and found that a data compiling error caused some individuals to be added to the wrong household and 1095B form. The Department is asking those who received incorrect information to destroy the form and is reviewing and updating its standard operating procedures for mailings. Individuals with questions or concerns can contact the Division at provided phone numbers or by email[1].

This incident is one of several data breaches affecting healthcare and related services in New Jersey, as other healthcare providers in the state have also faced cyberattacks and data breaches, resulting in various legal and regulatory responses[2][3][4][5][6][7][8][9][11][13].

Citations:

1. https://www.nj.gov/humanservices/njfcdata.html
2. https://www.law.com/njlawjournal/2023/12/20/new-jersey-hospital-operator-faces-class-suit-over-data-breach-alleged-failure-to-notify-patients/?slreturn=20240014005252
3. https://www.jdsupra.com/legalnews/neurosurgeons-of-new-jersey-confirms-4963456/
4. https://www.nj.gov/humanservices/news/pressreleases/2023/approved/20230711.shtml
5. https://healthitsecurity.com/news/nj-health-system-diverts-ambulances-amid-it-network-issue
6. https://www.njoag.gov/ag-grewal-nj-reaches-settlement-with-community-health-systems-over-data-breach-acute-care-hospital-operator-will-improve-data-security-pay-penalty/
7. https://www.mass.gov/doc/assigned-data-breach-number-30001-state-of-new-jersey-department-of-human-services/download
8. https://www.nj.com/healthfit/2023/01/a-cyberattack-on-a-nj-hospital-revealed-serious-vulnerabilities-more-are-coming.html
9. https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
10. https://casetext.com/case/morris-county-v-state-department-of-human-services
11. https://www.njoag.gov/new-jersey-health-care-providers-will-adopt-new-security-measures-and-pay-425000-to-settle-investigation-into-two-data-breaches/
12. https://www.njconsumeraffairs.gov/ocp/Pages/cyberfraud.aspx
13. https://www.hhs.gov/about/news/2023/06/05/hhs-office-civil-rights-reaches-agreement-health-care-provider-new-jersey-disclosed-phi-response-negative-online-reviews.html
14. https://www.njleg.state.nj.us/bill-search/2022/S3714/bill-text?f=S4000&n=3714_I1