Notification of Possible Personal Health Information Disclosure

News

FOR IMMEDIATE RELEASE
April 28, 2015

The New York City Health and Hospitals Corporation (HHC) this week began to notify about 90,000 HHC patients about the possible disclosure of some of their protected health information (PHI) that may have occurred when a former employee at HHC Jacobi Medical Center in the Bronx improperly accessed and transmitted files containing PHI to her personal email account and her email account at her new employer, which is a New York City agency. The unauthorized disclosure was discovered by HHC’s information governance and security program that, among other things, monitors and detects all email communications that contain PHI and other confidential information that are sent from HHC’s information systems without proper authorization. A sample notification to the affected patients is attached.

There is no evidence to suggest that the subject files were received or viewed by anyone other than the former employee, and there is no evidence to suggest that the PHI contained in these files was misused or further disclosed in any manner. Based on actions taken by HHC, the PHI has been deleted from all known unauthorized sites and sources to which it was sent and there is no basis to believe that it was forwarded to any other site before it was deleted.

Nonetheless, HHC has taken decisive steps to protect the individuals who are potentially affected, and through third-party vendor ID Experts, Inc. is offering free credit monitoring and identity protection services for one year to those patients whose medical records may have been improperly disclosed. HHC has also set up a toll-free hotline, 1-866-487-6522, to provide additional information. Notifications will also be posted on the HHC website and will be distributed to numerous New York area news outlets.

PHI in the emails included patient names, addresses, dates of birth, telephone numbers, medical record numbers, treatment dates and types of services, limited sensitive health information, and, for some patients, health insurance identification numbers which may have included their social security numbers.

HHC has taken immediate measures to prevent the recurrence of this incident, including the automatic blocking of communications containing PHI and other confidential information from being sent from HHC’s information systems to any site or entity outside of the HHC security network other than for legitimate business purposes.

Contact: HHC Press Office, (212) 788-3339

About HHC

The New York City Health and Hospitals Corporation (HHC) is a $6.7 billion integrated healthcare delivery system, the largest municipal healthcare organization in the country, and one of the New York area's largest providers of government-sponsored health insurance, MetroPlus Health Plan, the plan of choice for nearly half a million New Yorkers. HHC serves 1.4 million New Yorkers every year and more than 475,000 are uninsured. HHC provides medical, mental health and substance abuse services through its 11 acute care hospitals, five skilled nursing facilities, six large diagnostic and treatment centers and more than 70 community based clinics. HHC Health and Home Care also provides in-home services for New Yorkers. HHC was the 2008 recipient of the National Quality Forum and The Joint Commission's John M. Eisenberg Award for Innovation in Patient Safety and Quality. For more information, visit www.nyc.gov/hhc or find us on facebook.com/nycHHC or twitter.com/HHCnyc.