MONTEFIORE MEDICAL CENTER

Montefiore Medical Center reported to HHS on 2022-09-23 a Theft affecting 1332 individuals. Breached information located on Other Portable Electronic Device. A stolen USB drive contained PHI including names, DOB, emails, MRNs, and diagnoses. The entity provided credit monitoring and strengthened safeguards.

Montefiore Medical Center reported to HHS on 2022-04-22 a Unauthorized Access/Disclosure affecting 3717 individuals. Breached information located on Electronic Medical Record. An employee impermissibly accessed PHI including names, DOB, addresses, email, phone, insurance info, and partial SSN. The CE notified HHS, individuals, and media, and strengthened administrative, technical, and security safeguards.

Montefiore Medical Center (NY) reported to HHS OCR on 2021-04-13 an Unauthorized Access/Disclosure affecting 943 individuals. An employee impermissibly accessed PHI stored in Electronic Medical Records, including names, dates of birth, addresses, health insurance information, and partial Social Security numbers. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. Mitigation included strengthening administrative, technical, and security safeguards.

Montefiore Medical Center reported to HHS on 2020-12-01 a Unauthorized Access/Disclosure affecting 670 individuals. Breached information located on Paper/Films. An employee impermissibly accessed PHI including names, DOB, addresses, insurance info, and partial SSNs. The CE notified HHS, individuals, media, and posted substitute notice. Mitigation included strengthening administrative, technical, and security safeguards.

Montefiore Medical Center reported to HHS on 2020-09-18 a Unauthorized Access/Disclosure affecting 4004 individuals. Breached information located on Electronic Medical Record. An employee impermissibly accessed PHI including names, DOB, addresses, insurance info, and partial SSNs.

Montefiore Medical Center reported to HHS on 2020-09-14 a Hacking/IT Incident affecting 76,068 individuals. Breached information located on Network Server. A business associate experienced a ransomware attack affecting ePHI including names, addresses, dates of birth, and treatment information. The CE notified HHS, affected individuals, and the media.

Montefiore Medical Center (NYC non-profit hospital system) reported to HHS OCR on 2015-07-22 a Theft breach affecting 12,517 individuals. An employee stole ePHI from electronic medical records approximately two years prior (c. 2013) and sold it to an identity theft ring over a ~6-month period. NYPD notified Montefiore in May 2015. HHS OCR investigation resulted in a $4.75 million settlement and a corrective action plan. No business associate was involved.

Montefiore Medical Center (NY) reported to HHS on 2010-03-09 a Theft affecting 625 individuals. An unencrypted laptop was stolen from the covered entity's mobile dental van. The ePHI included names, dates of birth, medical record numbers, and dental x-rays. Following OCR's investigation, the CE centralized ePHI storage to a data center, encrypted all mobile dental van laptops, improved physical van security, enacted a new ePHI security policy, and retrained all staff. OCR obtained corrective action assurances.