Follow us: 

Patients First

Empowering New Yorkers to live the healthiest life possible.

Sign up for our newly imagined eNewsletter

Important notice on data breaches affecting some HHC patients


June 1, 2015 

Notification of Possible Personal Health Information Disclosure

Notification of Possible Personal Health Information Disclosure

The New York City Health and Hospitals Corporation (HHC) this week began to notify 3,957 HHC patients who received services at Metropolitan Hospital Center (Metropolitan) about the disclosure of some of their personal and/or protected health information (PHI) when an e-mail file that contained PHI (including some sensitive patient information) was improperly sent by a Metropolitan employee to his personal email account. A sample notification to the affected patients is attached explaining in greater detail the occurrence.

As indicated in the notice to the patients, there is no evidence to suggest that the subject file was received or viewed by anyone other than the single employee recipient, who was authorized to receive the PHI but was not authorized to transmit it to his personal email account. There is no evidence to suggest that the PHI contained in the e-mail file was misused or disclosed in any manner.  The employee responsible for sending the e-mail has been terminated from employment with Metropolitan. 

Consistent with federal regulatory requirements, HHC notified the federal oversight agency and initiated action to mitigate the risk presented by the unauthorized communication.

Based on actions taken by HHC, the email files in question have since been deleted from all known unauthorized sites to which they were sent and there is no basis to believe that they were forwarded to any other site before deletion.

Nonetheless, HHC has taken decisive steps to protect the individuals who are potentially affected, and through third-party vendor Kroll is offering free credit monitoring and identity protection services for one year to those patients whose medical records may have been improperly disclosed. HHC has also set up a toll-free hotline to provide additional information. Notifications will also be posted on the HHC website and will be distributed to news outlets.

HHC has taken immediate measures to prevent an incident of this nature from recurring in the future.  One of these measures include the automatic blocking of communications containing PHI and other personal information from being sent from HHC to any unauthorized site/entity outside of the HHC security network unless for a legitimate business purpose.


Share: PinterestTwitterTumblrLinkedIn
HHC Press Office(212) 788-3339

View all Media Contacts

HHC 2014 Stats

  • Staffed Beds: 6,684
  • Clinic Visits: 4,472,960
  • ER Visits: 1,179,436
  • Discharges: 205,791
  • Births: 18,564
Copyright 2015 The City of New York Contact Us Privacy Policy Terms of Use