Two New Jersey printing companies have agreed to pay $130,000 in state penalties and to implement new security policies, including appointing privacy and security officers, to resolve allegations that they violated the New Jersey Consumer Fraud Act and HIPAA in their handling of protected medical and client information.^[1]

The settlement, the second in as many months from New Jersey officials, is the latest of several recent actions involving enforcement of state-level health care privacy and security laws. In late August, California Attorney General Rob Bonta, D-Cal., issued a bulletin reminding health care providers that they have “a continuing obligation to comply with the requirements of state and federal health data privacy laws, especially those regarding health data breach reporting.”^[2]

In this case, Command Marketing Innovations LLC (CMI) and Strategic Content Imaging LLC (SCI) allegedly failed to safeguard sensitive information, ultimately disclosing the personal and protected health information (PHI) of approximately 55,715 residents.

The announcement from New Jersey Acting Attorney General Andrew Bruck and the state’s Division of Consumer Affairs did not identify the incident that resulted in the settlement, but the details match those in a 2016 printing breach involving Horizon Blue Cross Blue Shield of New Jersey.

“Specifically, CMI and SCI failed to detect a printing error that affected explanation of benefits statements mailed to New Jersey residents from October 31, 2016, through November 2, 2016, and caused improper disclosure of protected health information (PHI) such as claims numbers, dates of service, provider and facility names, and the descriptions of services provided relating to medical care received by these New Jersey residents,” the state agencies said in their announcement of the settlement.