NYC Health + Hospitals

# NYC Health + Hospitals Network Server Breach Report ## Opening Summary On June 6, 2025, NYC Health + Hospitals, one of the largest public healthcare systems in the United States, reported a significant data breach affecting 5,728 individuals. The breach resulted from unauthorized access to a network server, classified as a hacking or IT incident. This type of breach represents a direct compromise of the organization's information technology infrastructure, where threat actors gained unauthorized entry to systems containing protected health information (PHI). The incident underscores the ongoing cybersecurity challenges facing large healthcare organizations managing millions of patient records across multiple facilities and network endpoints. ## Investigation and Response Timeline Upon discovery of the unauthorized access to their network server, NYC Health + Hospitals initiated a comprehensive investigation to determine the scope and nature of the compromise. The organization worked to identify which patient records were accessed, what specific data elements were exposed, and the methods used by the threat actors to gain entry. Following standard HIPAA breach notification requirements, the organization began the process of notifying affected individuals within 60 days of discovery. The submission date of June 6, 2025, indicates when the breach was formally reported to regulatory authorities. During the investigation phase, the organization likely engaged cybersecurity forensics experts to analyze system logs, identify the attack vector, and implement remediation measures to prevent future unauthorized access. The involvement of a business associate in this breach suggests that the compromised data may have included information processed or stored by a third-party vendor contracted by NYC Health + Hospitals. ## Technical Details and Breach Mechanics Network server breaches typically occur through several common attack vectors, including exploitation of unpatched software vulnerabilities, credential compromise through phishing or brute-force attacks, or misconfigured access controls. When a network server is compromised, threat actors gain access to centralized data repositories that may contain records from multiple patient encounters, departments, and facilities. The fact that this breach affected a network server—rather than a single workstation or portable device—suggests a more systemic compromise with potentially broader data exposure. Network servers in healthcare environments typically store consolidated patient information including electronic health records (EHRs), billing data, and administrative information. The scale of 5,728 affected individuals indicates that the unauthorized access was discovered and contained before affecting the entire patient population of NYC Health + Hospitals, which serves hundreds of thousands of patients annually. The involvement of a business associate complicates the breach response, as the organization must coordinate notification efforts with the third party and ensure compliance with business associate agreement (BAA) requirements under HIPAA. ## Organizational Context NYC Health + Hospitals is a public benefit corporation and the largest municipal healthcare system in the United States, operating 11 acute care hospitals, four skilled nursing facilities, and numerous outpatient clinics throughout New York City's five boroughs. The system serves a diverse patient population of approximately 1.7 million individuals annually, including many uninsured and underinsured patients. As a public healthcare system, NYC Health + Hospitals operates under unique governance structures while maintaining the same HIPAA compliance obligations as private healthcare entities. The organization's expansive network infrastructure, multiple facilities, and integration with numerous business associates create a complex cybersecurity environment. The system's mission to provide healthcare access to all New Yorkers, regardless of ability to pay, means it maintains records on a particularly vulnerable population that may face heightened risks from identity theft and fraud. ## Patient Impact and Notification The breach affected 5,728 individuals whose protected health information may have been accessed through the compromised network server. While the specific data elements exposed were not detailed in the breach submission, network server compromises in healthcare settings typically expose multiple categories of PHI including names, dates of birth, medical record numbers, insurance information, and potentially clinical information from patient encounters. Affected individuals were notified of the breach in accordance with HIPAA's Breach Notification Rule, which requires covered entities to notify individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach. The notification likely included information about the nature of the breach, the types of information exposed, steps the organization was taking to investigate and remediate the incident, and recommended actions for patients to protect themselves from potential misuse of their information. Patients were likely advised to monitor their credit reports, review explanation of benefits statements for unauthorized services, and consider placing fraud alerts or credit freezes with credit reporting agencies. ## HIPAA Compliance and Industry Context Under the Health Insurance Portability and Accountability Act (HIPAA), covered entities like NYC Health + Hospitals are required to implement administrative, physical, and technical safeguards to protect patient privacy and security. Network server breaches represent a failure in technical safeguards, which should include access controls, encryption, audit controls, and integrity controls. The HIPAA Security Rule requires organizations to conduct regular risk assessments, implement appropriate security measures based on identified vulnerabilities, and maintain incident response procedures. Healthcare data breaches involving hacking or IT incidents have increased significantly in recent years, with the U.S. Department of Health and Human Services Office for Civil Rights (OCR) reporting hundreds of breaches annually affecting millions of individuals. Network-based attacks represent approximately 30-40% of healthcare data breaches, making them among the most common breach vectors in the industry. Large healthcare systems like NYC Health + Hospitals are particularly attractive targets for threat actors due to the volume and sensitivity of patient data they maintain. The involvement of a business associate in this breach highlights the importance of HIPAA's Business Associate Rule, which extends privacy and security requirements to third-party vendors handling PHI on behalf of covered entities.

# NYC Health + Hospitals Data Breach Report ## Incident Overview On December 22, 2023, NYC Health + Hospitals, one of the largest public healthcare systems in the United States, reported a data breach involving unauthorized access to protected health information (PHI) affecting approximately 1,500 individuals. The breach involved unauthorized access to patient records stored on desktop computers and physical media including paper documents and film records. This incident represents a significant security event for the organization and triggers mandatory notification requirements under the Health Insurance Portability and Accountability Act (HIPAA). ## Discovery and Response Timeline The unauthorized access was discovered through the organization's security monitoring and incident response procedures. Upon discovery, NYC Health + Hospitals initiated a comprehensive investigation to determine the scope of the breach, identify affected individuals, and assess what specific patient information may have been compromised. The organization worked to secure affected systems and prevent further unauthorized access. In accordance with HIPAA Breach Notification Rule requirements, the organization began the process of notifying affected individuals, their families, and relevant regulatory authorities. The submission date of December 22, 2023, indicates the breach was reported to the Department of Health and Human Services (HHS) within the required 60-day notification window. ## Breach Mechanics and Technical Details The breach involved unauthorized access to information stored on desktop computers as well as physical media including paper records and film materials. This multi-vector breach suggests either a compromised user account, inadequate access controls, or physical security vulnerabilities. Desktop computer breaches typically occur through credential compromise, malware infection, or exploitation of unpatched software vulnerabilities. The involvement of physical media (paper and film) indicates that unauthorized individuals may have gained access to physical storage areas or that records were improperly secured. This hybrid breach—combining both digital and physical security failures—suggests systemic vulnerabilities in the organization's information governance practices. The fact that no business associate was involved indicates the breach originated from within NYC Health + Hospitals' own infrastructure or personnel. ## Organizational Context NYC Health + Hospitals is a public benefit corporation and the largest municipal healthcare system in the United States, operating 11 acute care hospitals, four skilled nursing facilities, and numerous outpatient clinics and diagnostic centers throughout New York City. The system serves over 1.7 million patients annually, including a significant population of uninsured and underinsured individuals. As a major healthcare provider in one of the nation's largest metropolitan areas, NYC Health + Hospitals maintains extensive patient records spanning decades of clinical care. The organization's infrastructure includes numerous legacy systems, modern electronic health record platforms, and distributed storage of both digital and physical records across multiple facilities. This complexity, combined with the organization's mission to serve vulnerable populations, creates both operational challenges and heightened responsibility for protecting patient privacy. ## Patient Impact and Affected Population Approximately 1,500 individuals had their protected health information potentially exposed through this unauthorized access incident. The affected population includes patients who received care at NYC Health + Hospitals facilities and whose records were stored on the compromised desktop computers or in the physical media that was accessed. While the specific identities and demographics of affected individuals were not disclosed in the breach submission, patients should assume their information may have been compromised if they received care at NYC Health + Hospitals facilities during the relevant time period. The organization was required to provide individual notification to each affected person, along with information about the breach, the types of data exposed, steps being taken to mitigate harm, and resources available to affected individuals. Notification letters typically include details about credit monitoring services, identity theft protection resources, and instructions for contacting the organization with questions. ## HIPAA Compliance and Regulatory Context Under the HIPAA Breach Notification Rule, covered entities like NYC Health + Hospitals must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. The organization must also notify prominent media outlets and the Secretary of the Department of Health and Human Services. This breach demonstrates the ongoing challenge healthcare organizations face in protecting patient information across multiple storage modalities and access points. Unauthorized access breaches represent a significant category of healthcare data incidents, accounting for a substantial portion of reported breaches annually. The involvement of both digital systems and physical records highlights the importance of comprehensive security programs that address not only cybersecurity but also physical security, access controls, employee training, and information governance. Healthcare organizations are required to conduct risk assessments, implement safeguards, and maintain audit controls to detect and prevent unauthorized access to PHI.

# NYC Health + Hospitals Data Breach Report ## Incident Overview On December 2, 2022, NYC Health + Hospitals, one of the largest public healthcare systems in the United States, reported a data breach affecting 2,174 individuals. The breach resulted from the loss of a portable electronic device containing protected health information (PHI). This incident represents a significant security event for the organization, which serves millions of patients across New York City's five boroughs. The loss of portable devices remains one of the most common vectors for healthcare data breaches, as these devices are inherently mobile and vulnerable to theft or misplacement. ## Discovery and Response Timeline NYC Health + Hospitals discovered the loss of the portable electronic device and subsequently initiated an investigation to determine the scope and nature of the data exposure. Upon discovery, the organization followed HIPAA breach notification requirements by conducting a thorough risk assessment to evaluate whether the breach posed a significant risk of harm to affected individuals. The organization notified affected patients of the breach on or around the submission date of December 2, 2022, in compliance with the HIPAA Breach Notification Rule, which requires notification without unreasonable delay and no later than 60 calendar days after discovery of a breach. The investigation process included attempts to locate the device, assessment of whether the data was actually accessed or merely at risk of access, and evaluation of any security measures that may have protected the information. ## Specific Details of the Breach The breach involved the loss of a portable electronic device, which typically includes laptops, tablets, USB drives, external hard drives, or mobile devices used by healthcare personnel for clinical documentation, patient communication, or administrative purposes. Portable devices represent a particular vulnerability in healthcare settings because they frequently leave secure facilities, travel with staff members, and may not have the same level of physical security as stationary network infrastructure. The loss occurred at an unspecified location classified as "Other Portable Electronic Device," indicating the device was not recovered and its current location remains unknown. Without confirmation of device recovery or data access, the organization must assume the worst-case scenario for notification purposes—that the information may have been accessed by unauthorized parties. The device may or may not have contained encryption or other technical safeguards; the breach notification does not specify whether the device had password protection, full-disk encryption, or remote wipe capabilities that might have mitigated the exposure. ## Organizational Context NYC Health + Hospitals (NYC H+H) is a public benefit corporation and the largest municipal healthcare system in the United States, operating 11 acute care hospitals, four skilled nursing facilities, and numerous outpatient clinics and diagnostic centers throughout New York City. The system serves approximately 1.4 million patients annually, including a significant proportion of uninsured and underinsured individuals. As a public healthcare system, NYC H+H operates under unique governance structures and serves as a safety-net provider for the city's most vulnerable populations. The organization's scale and complexity—with thousands of employees across multiple facilities and boroughs—creates significant challenges for data security and device management. The loss of a portable device within such a large, distributed organization underscores the difficulty of maintaining comprehensive inventory control and security protocols across numerous locations and personnel. ## Patient Impact and Affected Population The breach affected 2,174 individuals whose protected health information was stored on the lost portable device. While the specific data elements exposed are not detailed in the breach submission, portable devices in healthcare settings typically contain some combination of patient names, medical record numbers, dates of birth, addresses, phone numbers, insurance information, and clinical notes or treatment details. The affected population likely includes patients who received care at one or more NYC H+H facilities during the period when the device was in use. Notification letters were sent to affected individuals informing them of the breach, the types of information potentially exposed, the steps the organization was taking to investigate, and recommended actions for protecting themselves against potential misuse of their information. The organization likely offered complimentary credit monitoring or identity theft protection services for a specified period, as is standard practice in healthcare breaches involving personal identifiers. ## HIPAA Compliance and Industry Context Under the HIPAA Breach Notification Rule (45 CFR §§ 164.400-414), covered entities and business associates must notify affected individuals of breaches of unsecured PHI. A breach is defined as the unauthorized acquisition, access, use, or disclosure of PHI that compromises the security or privacy of the information. The loss of a device containing PHI is presumed to be a breach unless the organization can demonstrate through a risk assessment that there is a low probability that the PHI has been compromised. The risk assessment must consider factors including the nature and extent of the PHI involved, who accessed or may have accessed the PHI, whether the PHI was actually acquired or accessed, and the extent to which the risk has been mitigated. Portable device losses represent a persistent challenge in healthcare security; according to industry reports, lost or stolen laptops, tablets, and mobile devices account for a significant percentage of healthcare data breaches annually. The absence of a business associate in this breach indicates the device and data were directly under the control of NYC H+H rather than a third-party vendor, placing full responsibility for the breach response on the organization itself. This incident reflects broader industry trends regarding the tension between clinical mobility (the need for healthcare workers to access patient information at point-of-care) and data security (the need to protect sensitive information from loss and unauthorized access).