MONTEFIORE MEDICAL CENTER

HHS OCR settled with Montefiore Medical Center (MMC) for $4.75M regarding a malicious insider breach. An employee accessed and sold PHI of 12,517 patients. MMC failed risk analysis, audit controls, and activity review. Settlement includes a Corrective Action Plan.

Montefiore Medical Center reported to HHS on 2022-09-23 a Theft affecting 1332 individuals. Breached information located on Other Portable Electronic Device. A stolen USB drive contained PHI including names, DOB, emails, MRNs, and diagnoses. The entity provided credit monitoring and strengthened safeguards.

Montefiore Medical Center reported to HHS on 2022-04-22 a Unauthorized Access/Disclosure affecting 3717 individuals. Breached information located on Electronic Medical Record. An employee impermissibly accessed PHI including names, DOB, addresses, email, phone, insurance info, and partial SSN. The CE notified HHS, individuals, and media, and strengthened administrative, technical, and security safeguards.

Montefiore Medical Center (NY) reported to HHS OCR on 2021-04-13 an Unauthorized Access/Disclosure affecting 943 individuals. An employee impermissibly accessed PHI stored in Electronic Medical Records, including names, dates of birth, addresses, health insurance information, and partial Social Security numbers. The CE notified HHS, affected individuals, the media, and posted substitute notice on its website. Mitigation included strengthening administrative, technical, and security safeguards.

Montefiore Medical Center reported to HHS on 2021-01-29 an Unauthorized Access/Disclosure affecting 1,670 individuals. Breached information located on Electronic Medical Record. An employee impermissibly accessed PHI including names, DOB, addresses, insurance info, and partial SSNs.

Montefiore Medical Center reported to HHS on 2020-12-01 a Unauthorized Access/Disclosure affecting 670 individuals. Breached information located on Paper/Films. An employee impermissibly accessed PHI including names, DOB, addresses, insurance info, and partial SSNs. The CE notified HHS, individuals, media, and posted substitute notice. Mitigation included strengthening administrative, technical, and security safeguards.

Montefiore Medical Center reported to HHS on 2020-09-18 a Unauthorized Access/Disclosure affecting 4004 individuals. Breached information located on Electronic Medical Record. An employee impermissibly accessed PHI including names, DOB, addresses, insurance info, and partial SSNs.

Montefiore Medical Center reported to HHS on 2020-09-14 a Hacking/IT Incident affecting 76,068 individuals. Breached information located on Network Server. A business associate experienced a ransomware attack affecting ePHI including names, addresses, dates of birth, and treatment information. The CE notified HHS, affected individuals, and the media.

MONTEFIORE MEDICAL CENTER filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-399). The register records the breach as discovered on February 7, 2020. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Montefiore Medical Center (NYC non-profit hospital system) reported to HHS OCR on 2015-07-22 a Theft breach affecting 12,517 individuals. An employee stole ePHI from electronic medical records approximately two years prior (c. 2013) and sold it to an identity theft ring over a ~6-month period. NYPD notified Montefiore in May 2015. HHS OCR investigation resulted in a $4.75 million settlement and a corrective action plan. No business associate was involved.

Montefiore Medical Center reported to HHS on 2010-07-23 a Theft affecting 23753 individuals. Breached information located on Desktop Computer. Unencrypted desktop computers containing ePHI (names, MRNs, DOB, diagnoses) were stolen. CE filed police report, notified individuals/HHS, encrypted computers, removed ePHI from desktops, and enhanced physical security.

Montefiore Medical Center reported to HHS on 2010-07-23 a Theft affecting 16,820 individuals. Breached information located on Desktop Computer. Two unencrypted desktop computers containing ePHI (medical record numbers, DOB, SSN, billing codes) were stolen. Remediation included encrypting computers, moving data to centralized servers, and physical security upgrades.

Montefiore Medical Center (NY) reported to HHS on 2010-03-09 a Theft affecting 625 individuals. An unencrypted laptop was stolen from the covered entity's mobile dental van. The ePHI included names, dates of birth, medical record numbers, and dental x-rays. Following OCR's investigation, the CE centralized ePHI storage to a data center, encrypted all mobile dental van laptops, improved physical van security, enacted a new ePHI security policy, and retrained all staff. OCR obtained corrective action assurances.