Healthcare
,
Industry Specific
Incidents Are Unrelated, Says NYC Health + Hospitals
Hackers had access to New York City’s municipal healthcare system for nearly three months before being detected, stealing data of an undisclosed number of patients.
See Also: Reduce Cloud Risk in Healthcare with Security by Default
The incident is the second hacking-related data breach within weeks involving a third-party firm hired by public benefit corporation New York City Health and Hospitals Corp.
Better known as NYC Health + Hospitals, the hospital system serves more than 1 million patients annually as a safety-net health system with 70 locations across the city’s five boroughs.
In a March 24 breach notice, the system said hackers appeared to have gained access to its systems “due to a security breach at a third-party vendor.”
The breach disclosure comes shortly after the healthcare organization on March 11 said it was notifying 5,086 of its patients of a hacking incident at one of its care management agency partners, the National Association on Drug Abuse Programs, which provides care coordination services to individuals who receive services under a NYC Health home health program.
A NYC Health spokesman told Information Security Media Group that the two data breaches are separate incidents.
Information affected in the most recent data breach includes health insurance information, medical information – such as diagnoses, medications, test results and treatment plans – biometric information, including fingerprints and palm prints, billing claims and payment information.
Also potentially compromised was individuals’ other personal information such as Social Security numbers, driver’s license numbers, precise geolocation data, payment card numbers, financial account information or credentials and online account credentials.
In its March 11 breach notice specifically naming NADAP, NYC Health said patient information accessed included names, dates of birth, addresses, Medicaid numbers and clinical information related to their health home care provided by NADAP, as well as their Social Security numbers.
NYC Health wasn’t the only customer affected by the NADAP breach, also encompassing a number of other undisclosed clients in an incident that affected a total of 90,000 individuals.
“We have implemented additional measures to enhance network security and minimize the risk of a similar incident occurring in the future,” NADAP said.