NYC Health + Hospitals

NYC Health + Hospitals reported to HHS on 2026-06-18 a Unauthorized Access/Disclosure affecting 58778 individuals. Breached information located on Other. Business associate was present.

NYC Health + Hospitals, a healthcare provider in New York, reported to HHS OCR on 2026-03-10 a Hacking/IT Incident affecting 5,086 individuals. Breached information was located on a Network Server. A business associate was present.

NYC Health + Hospitals reported to HHS on 2025-06-06 a Hacking/IT Incident affecting 5728 individuals. Breached information located on Network Server. Business associate present.

UKG, a workforce management provider, disclosed that on April 17, 2023, an employee inadvertently saved a file containing personal information of New York City Health + Hospitals employees to a shared folder. This file was copied to five other customer environments for training. UKG discovered the incident on October 30, 2023. Approximately 3 New Hampshire residents were affected. UKG deleted the file, notified customers, and offered credit monitoring.

NYC Health + Hospitals reported to HHS on 2023-12-22 a Unauthorized Access/Disclosure affecting 3000 individuals. Breached information located on Desktop Computer, Paper/Films. An employee allowed a volunteer to view PHI (names, DOB, lab results). The entity notified HHS, individuals, and media, sanctioned the employee, and retrained staff.

NYC Health + Hospitals reported to HHS on 2022-12-02 a Loss affecting 2174 individuals. The breach involved the loss of a hard drive for a visual field-testing device containing protected health information (PHI), including names, dates of birth, and treatment information. The breached information was located on an Other Portable Electronic Device.

NYC Health + Hospitals reported to HHS on 2021-06-30 a Hacking/IT Incident (ransomware) affecting 43,727 individuals. The CE's business associate was the victim of a ransomware attack that compromised ePHI stored on a network server. ePHI involved included names, dates of birth, medications prescribed, and other treatment information. The CE notified HHS, affected individuals, the media, and posted a substitute notice on its website.

New York City Health and Hospitals Corporation - Metropolitan Hospital Center reported to HHS on 2015-06-01 a Unauthorized Access/Disclosure affecting 3957 individuals. Breached information located on Email.

New York City Health & Hospitals Corporation reported to HHS on 2014-10-10 an Unauthorized Access/Disclosure affecting 10,058 individuals. Breached information located on Paper/Films. 198 boxes of PHI containing names, addresses, DOBs, SSNs, and financial/medical data were discovered in an employee parking garage.