NYC Health + Hospitals Data Breach Report

Incident Overview

On December 22, 2023, NYC Health + Hospitals, one of the largest public healthcare systems in the United States, reported a data breach involving unauthorized access to protected health information (PHI) affecting approximately 1,500 individuals. The breach involved unauthorized access to patient records stored on desktop computers and physical media including paper documents and film records. This incident represents a significant security event for the organization and triggers mandatory notification requirements under the Health Insurance Portability and Accountability Act (HIPAA).

Discovery and Response Timeline

The unauthorized access was discovered through the organization's security monitoring and incident response procedures. Upon discovery, NYC Health + Hospitals initiated a comprehensive investigation to determine the scope of the breach, identify affected individuals, and assess what specific patient information may have been compromised. The organization worked to secure affected systems and prevent further unauthorized access. In accordance with HIPAA Breach Notification Rule requirements, the organization began the process of notifying affected individuals, their families, and relevant regulatory authorities. The submission date of December 22, 2023, indicates the breach was reported to the Department of Health and Human Services (HHS) within the required 60-day notification window.

Breach Mechanics and Technical Details

The breach involved unauthorized access to information stored on desktop computers as well as physical media including paper records and film materials. This multi-vector breach suggests either a compromised user account, inadequate access controls, or physical security vulnerabilities. Desktop computer breaches typically occur through credential compromise, malware infection, or exploitation of unpatched software vulnerabilities. The involvement of physical media (paper and film) indicates that unauthorized individuals may have gained access to physical storage areas or that records were improperly secured. This hybrid breach—combining both digital and physical security failures—suggests systemic vulnerabilities in the organization's information governance practices. The fact that no business associate was involved indicates the breach originated from within NYC Health + Hospitals' own infrastructure or personnel.

Organizational Context

NYC Health + Hospitals is a public benefit corporation and the largest municipal healthcare system in the United States, operating 11 acute care hospitals, four skilled nursing facilities, and numerous outpatient clinics and diagnostic centers throughout New York City. The system serves over 1.7 million patients annually, including a significant population of uninsured and underinsured individuals. As a major healthcare provider in one of the nation's largest metropolitan areas, NYC Health + Hospitals maintains extensive patient records spanning decades of clinical care. The organization's infrastructure includes numerous legacy systems, modern electronic health record platforms, and distributed storage of both digital and physical records across multiple facilities. This complexity, combined with the organization's mission to serve vulnerable populations, creates both operational challenges and heightened responsibility for protecting patient privacy.

Patient Impact and Affected Population

Approximately 1,500 individuals had their protected health information potentially exposed through this unauthorized access incident. The affected population includes patients who received care at NYC Health + Hospitals facilities and whose records were stored on the compromised desktop computers or in the physical media that was accessed. While the specific identities and demographics of affected individuals were not disclosed in the breach submission, patients should assume their information may have been compromised if they received care at NYC Health + Hospitals facilities during the relevant time period. The organization was required to provide individual notification to each affected person, along with information about the breach, the types of data exposed, steps being taken to mitigate harm, and resources available to affected individuals. Notification letters typically include details about credit monitoring services, identity theft protection resources, and instructions for contacting the organization with questions.

HIPAA Compliance and Regulatory Context

Under the HIPAA Breach Notification Rule, covered entities like NYC Health + Hospitals must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. The organization must also notify prominent media outlets and the Secretary of the Department of Health and Human Services. This breach demonstrates the ongoing challenge healthcare organizations face in protecting patient information across multiple storage modalities and access points. Unauthorized access breaches represent a significant category of healthcare data incidents, accounting for a substantial portion of reported breaches annually. The involvement of both digital systems and physical records highlights the importance of comprehensive security programs that address not only cybersecurity but also physical security, access controls, employee training, and information governance. Healthcare organizations are required to conduct risk assessments, implement safeguards, and maintain audit controls to detect and prevent unauthorized access to PHI.