Notification of Possible Personal Health Information Disclosure

News

FOR IMMEDIATE RELEASE
June 1, 2015

The New York City Health and Hospitals Corporation (HHC) this week began to notify 3,957 HHC patients who received services at Metropolitan Hospital Center (Metropolitan) about the disclosure of some of their personal and/or protected health information (PHI) when an e-mail file that contained PHI (including some sensitive patient information) was improperly sent by a Metropolitan employee to his personal email account. A sample notification to the affected patients is attached explaining in greater detail the occurrence.

As indicated in the notice to the patients, there is no evidence to suggest that the subject file was received or viewed by anyone other than the single employee recipient, who was authorized to receive the PHI but was not authorized to transmit it to his personal email account. There is no evidence to suggest that the PHI contained in the e-mail file was misused or disclosed in any manner. The employee responsible for sending the e-mail has been terminated from employment with Metropolitan.

Consistent with federal regulatory requirements, HHC notified the federal oversight agency and initiated action to mitigate the risk presented by the unauthorized communication.

Based on actions taken by HHC, the email files in question have since been deleted from all known unauthorized sites to which they were sent and there is no basis to believe that they were forwarded to any other site before deletion.

Nonetheless, HHC has taken decisive steps to protect the individuals who are potentially affected, and through third-party vendor Kroll is offering free credit monitoring and identity protection services for one year to those patients whose medical records may have been improperly disclosed. HHC has also set up a toll-free hotline to provide additional information. Notifications will also be posted on the HHC website and will be distributed to news outlets.

HHC has taken immediate measures to prevent an incident of this nature from recurring in the future. One of these measures include the automatic blocking of communications containing PHI and other personal information from being sent from HHC to any unauthorized site/entity outside of the HHC security network unless for a legitimate business purpose.

Contact: HHC Press Office, (212) 788-3339

About HHC

The New York City Health and Hospitals Corporation (HHC) is a $6.7 billion integrated healthcare delivery system, the largest municipal healthcare organization in the country, and one of the New York area's largest providers of government-sponsored health insurance, MetroPlus Health Plan, the plan of choice for nearly half a million New Yorkers. HHC serves 1.4 million New Yorkers every year and more than 475,000 are uninsured. HHC provides medical, mental health and substance abuse services through its 11 acute care hospitals, five skilled nursing facilities, six large diagnostic and treatment centers and more than 70 community based clinics. HHC Health and Home Care also provides in-home services for New Yorkers. HHC was the 2008 recipient of the National Quality Forum and The Joint Commission's John M. Eisenberg Award for Innovation in Patient Safety and Quality. For more information, visit www.nyc.gov/hhc or find us on facebook.com/nycHHC or twitter.com/HHCnyc.