FREQUENTLY ASKED QUESTIONS:

Q: What is the North Bronx Healthcare Network?

A: The North Bronx Healthcare Network is part of the New York City Health and Hospitals Corporation, commonly called "HHC." The Network consists of Jacobi Medical Center, North Central Bronx Hospital and two affiliated community healthcare centers: the Health Center at Tremont and the Health Center at Gun Hill. If you were a patient, or a Network workforce member, at any of these facilities between 1991 and early December 2010, you may be affected by this incident.

Q: What was this incident?

A: On December 23, 2010, computer backup tapes for two North Bronx computer systems were stolen from the truck of our vendor GRM Information Management Services while being taken to a secure storage location. The GRM truck was parked on the street in Manhattan at the time of the theft while the driver was making a pickup from another GRM customer. Our tapes contained patient protected health information.

Please be assured that only a person with specialized knowledge and access to the right software and computer hardware would be able to view the information on the stolen tapes. However, in the interest of the safety and protection of our patients' personal and health information, and to secure them from harm, we have arranged for each affected party, at his or her option, to receive identity protection services from Debix, the Identity Protection Network.

The North Bronx Healthcare Network regrets any inconvenience that this incident may cause you. Although we do not have any proof that your private information was accessed by any unauthorized persons, we are required by law to notify all individuals affected under the circumstances of this unfortunate incident.

Q: Why was my information stored on these tapes?

A: The North Bronx Healthcare Network is responsible for protecting our patients' health information from possible loss or destruction caused by natural disasters, such as flood or fire, or intentional harm, such as computer hacking. To meet this responsibility we routinely make backups of all data contained in our computer systems. As a necessary precaution, backup tapes are taken to a secure offsite location in case our computer system is damaged or destroyed by natural or manmade causes. To transport and store the backup tapes, we use a vendor, in this case GRM Information Management Services.

Q: What information about me is on the stolen tapes?

A: The tapes contain protected health information such as full name, address, social security number, medical record number, health insurance information, diagnosis and treatment data, telephone number(s), birth, admission and discharge dates and mother's maiden name, that is, if you provided this information to us at the time you received care at a North Bronx Healthcare facility. Network workforce members may have other personal information on the stolen tapes, such as professional licensure number and social security number.

Q: Has someone read or seen my private information?

A: There is simply no evidence indicating that any of the information on the stolen tapes has actually been accessed by an unauthorized individual. We will be monitoring, through Debix and other resources, whether this information is being used for purposes of identity theft. We will post updates regarding the possible misuse of the information on our website: www.nyc.gov/hhc.

Q: What are you doing about this breach and the person(s) who caused it?

A: Upon discovery that the tapes were stolen on December 23, 2010, our vendor GRM Information Management Services notified the North Bronx Healthcare Network and the New York City Police Department the same day. An investigation was launched immediately to find the tapes and discover, if possible, who stole them. To date, we have not been able to recover the tapes or find the individual, or individuals, responsible for the theft. To prevent an incident such as this from happening again, the North Bronx Healthcare Network, as well as all other HHC data centers, will expedite plans to encrypt all future backup tapes. Encrypting these tapes involves using a mathematical code or algorithm to convert the data stored on the tapes to a form that is unreadable to an unauthorized person. As the investigation continues, you may check our website, www.nyc.gov/hhc , for status updates.

Q: What is North Bronx Healthcare Network going to do to prevent me from becoming a victim of identity theft?

A: We have engaged the services of Debix, the Identity Protection Network, to provide you with free credit monitoring services for all of the individuals whose information was affected by this incident. Under these services your credit records will be under constant review for any signs of medical, financial, and criminal identity theft. These credit monitoring services include OnCall Credit Alerts. These alerts will let you know-by telephone or email-immediately if someone has misused your credit information. You may also contact Debix directly if you believe someone has stolen your identity, and they will investigate your claim.

Debix will also provide Fraud Resolution Services to restore your credit to its original status for any adverse consequences that occurred on or after December 23, 2010, arising from this incident. If, in fact, your credit has been misused by an unauthorized person, you may be entitled to reimbursement up to $1 million under Debix Identity Theft Insurance Coverage for certain costs incurred during the identity restoration process. . This coverage includes reimbursement for credit restoration costs you incur, legal expenses, and lost wages resulting from identity theft.

Q: Was my spouse or other family members' information also affected?

A: We will attempt to contact all North Bronx Healthcare Network patients, that is, anyone who received care at Jacobi Medical Center, North Central Bronx Hospital, the Health Center at Tremont, or the Health Center at Gun Hill, and Network workforce members who were affected by this incident. A letter has been mailed to every individual whose name and address are on file. Anyone who does not receive a letter, but is concerned that he or she may be affected because of a visit to one of the North Bronx Healthcare Network facilities, may call this hotline (877-412-7148) to find out.

Unfortunately, for security and privacy purposes, we cannot give this information to you. Your family member must contact us directly so they can answer a series of security questions to confirm their identity as an individual affected by this incident.

However, if you are notified as the parent or guardian of an affected minor, you may call on behalf of the minor and we will provide you with additional information and support.

Q: Is my information lost or gone for good?

A: No. All of the information on the tapes is backed up and secure. All of your information is still contained in our records at the North Bronx Healthcare Network. No unique information has been lost.

Q: Why did it take so long to notify me about this?

A: Because of the circumstances surrounding this incident, we were required to review and sort a significant number of data files in order to find out exactly what types of information and whose information was contained on the stolen backup tapes. This process was necessary to ensure that we had a complete list of all affected individuals so we could properly notify each person and provide them with meaningful information on how to protect themselves from any possible adverse effects arising from this incident.

HHC originally mailed notices in February 2011 to individuals affected by this incident whose complete mailing addresses were on file. If the first notice you received was dated March 2011, it is because HHC did not have your full address in its records before then. In order to obtain a complete address to send you the notice you have now received, HHC had to request the assistance of the New York City Department of Information Technology and Telecommunications (DOITT). This process necessarily took time. However, be assured that if you now sign up for Debix credit monitoring services, you will be protected by Debix’s fraud resolution services and fraud identity theft insurance for any adverse consequences that arose on or after December 23, 2010, the date the backup tapes were stolen.

Please Note: HHC did not share your name or social security number with DOITT, only a partial address, which DOITT was able to complete with borough, state and zip code information.

Q: I received another letter. Why? Was my information lost again?

A: If you have received a letter or letters identical, or almost identical, to one you previously received that was dated February 2011, be assured that you are not being informed of another security breach. Both letters are reporting the same theft of North Bronx Healthcare Network backup tapes that occurred on December 23, 2010. You are receiving another letter for one of two reasons.

If the second letter that you received is identical to the one you received earlier, then HHC sent you a second letter in a second mailing done with the assistance of a City agency, the Department of Information Technology and Telecommunications (DOITT), which maintains a comprehensive city mapping program. As a result of this effort, HHC was able to do a second mailing to assist in ensuring that all affected individuals receive notice and have an opportunity to enroll for Debix credit monitoring services on or before June 30, 2011. Because your information may have been located in multiple files in the backup tapes that were stolen, you may have been included in the first group of mailing and in the group with incomplete addresses. That is why you received an identical second notification.

Please Note: HHC did not share your name or social security number with DOITT, only a partial address, which DOITT was able to complete with borough, state and zip code information.

If the letter is different from the first one you received, it mentions at the end of the first paragraph either “personally identifiable employee medical information (“PIEMI”)” or “personal information, which was entered into QuadraMed in order for the North Bronx to grant you access to the QuadraMed system." This second letter is an additional notice that HHC is mailing to you to avoid any confusion regarding whether you were or were not affected by this security breach incident because you may not have been a patient at a North Bronx Healthcare Network facility. In describing the security breach incident, the letter you first received dated February 2011 mentions “the privacy and confidentiality of our patients’ private information” and describes the loss of “some of your protected health information”. This letter was sent to everyone affected by the incident for whom we had accurate mailing information regardless of whether they were patients or HHC workforce members, or employees of vendors, contractors or other third parties whose private information may have been on the backup tapes because they received a health screening by Occupational Health Service at Jacobi or North Central Bronx, or were entered in Quadramed, the HHC clinical system, as a system user. We want to be very clear: even though you were not a patient, your personal information was on the stolen backup tapes either because you received a health screening through Occupational Health Service, or because of your employment by a North Bronx Healthcare facility or a vendor or contractor who was performing services for the North Bronx Healthcare Network. Therefore you should consider very carefully signing up for credit monitoring services through Debix, or following the other measures raised in the letters you have received concerning this event.