Data Breach Notification

Notification of Possible Personal Health Information Disclosure

The New York City Health and Hospitals Corporation (HHC) this week began to notify 10,058 patients who received services at four now-closed clinics in Brooklyn about the possible disclosure of some of their personal or protected health information (PHI) when records were improperly stored in boxes in an enclosed employee parking garage at the East New York Diagnostic and Treatment Center. A sample notification to the affected patients at (1) the Howard Houses Child Health Center; (2) the Brevoort Houses Child Health Clinic; (3) the Fifth Avenue Child Health Clinic and (4) the Brownsville Child Health Clinic is attached.

There is no evidence to suggest that the files were accessible to the general public or that the protected health information in the files has, in fact, had been improperly accessed by any person or entity. Nonetheless, the records were stored in a manner that HHC staff without authority to access such records could have accessed them.

In an abundance of caution, HHC has taken decisive steps to protect the individuals who are potentially affected, by immediately securing and removing the boxes of records and properly storing them, and timely notifying the required federal oversight agency.

HHC, through third party vendor AllClear ID, Inc. is offering free credit monitoring and identity protection services for one year to those patients whose medical records were stored in the garage. HHC has also set up a toll-free hotline, 1-866-979-2599, to provide additional information. Notifications will also be posted on the HHC website and will be distributed to numerous New York area news outlets.

Personal health information can include name, address, diagnosis, medications, treatment regimen, medical record number, and social security number.

HHC has taken immediate measures to prevent a reoccurrence of this incident by increasing the number of security and privacy walk-throughs it conducts at its facilities and by ensuring that the HHC workforce is reminded of the importance of managing PHI in a safe and secure manner and of reporting any incidents where that is not the case.