The Mount Sinai Medical Center, Inc.

Mount Sinai Medical Center notified patients that its billing vendor, American Medical Collection Agency (AMCA), experienced unauthorized access to systems containing patient PHI, names, and financial info between Aug 2018 and Mar 2019. Mount Sinai's systems were not directly affected. Mount Sinai terminated the relationship with AMCA.

MOUNT SINAI MEDICAL CENTER filed a data-breach notice with the Illinois Attorney General during 2019 (case 2019-332). The register records the breach as discovered on August 1, 2018. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Mount Sinai Medical Center reported to HHS on 2015-03-20 a Unauthorized Access/Disclosure affecting 1406 individuals. Breached information located on Paper/Films. An employee printed paper face sheets containing demographic and clinical information in excess of job duties for an illicit purpose. The entity terminated the employee, retrained staff, and limited printing policies.

Mount Sinai Medical Center (NY) reported to HHS OCR on 2013-10-21 the loss of a provider's personal unencrypted USB drive containing PHI for 610 individuals. The drive included names, dates of birth, medical record numbers, procedure logs, procedure dates, procedure information, and clinical information. The CE sanctioned the provider, retrained staff on HIPAA, and was directed by OCR to conduct a risk analysis, update portable-device policies, and implement encryption requirements for personally owned devices.

Mount Sinai Medical Center (NY) reported to HHS OCR on 2013-10-04 an Improper Disposal breach affecting 1,586 individuals. A trash vendor placed two garbage bags of PHI in an open box outside the Department of Preventive Medicine with regular trash. PHI included patient names, dates of service, payer information, clinical information, mental health information, and Social Security numbers (Paper/Films). CE retrieved the materials, retrained staff, and sanctioned the responsible supervisor. OCR provided TA on accounting of disclosures.

Mount Sinai Medical Center reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2013-03-15. 2 Massachusetts residents were affected. The report records the breach type as undefined.

Mount Sinai Medical Center reported to HHS on 2013-03-15 a Theft affecting 628 individuals. Breached information located on Desktop Computer, Paper/Films.

Mount Sinai Medical Center (FL) reported to HHS OCR on 2010-03-23 a Theft affecting 2,600 individuals. Breached information was located on a Laptop. No business associate was involved. No further description was provided.