Huntington Hospital northwell.edu Huntington Hospital data breach: what happened and what to do
A former night-shift employee at Huntington Hospital in New York looked at patient records without authorization between October 2018 and February 2019. The hospital told HHS 12,925 people were affected and notified them on November 24, 2021.
View all 13,177 breaches- Breach date
- Oct 2018
- Made public
- 24 Nov 2021
- Affected
- 12,925
- Data exposed
- Names, Dates of birth, Physical addresses, Phone numbers, Medical record numbers, Diagnoses, Medications, Lab results
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Huntington Hospital, part of the Northwell Health system in New York, said an employee accessed patient records they had no job reason to open. It reported the incident to the US Department of Health and Human Services as affecting 12,925 people.
What happened
The hospital said a night-shift employee viewed patient information between October 2018 and February 2019. It found out on February 25, 2019, suspended the employee, and later ended their employment. Law enforcement asked it to hold off on notifying patients, so letters went out on November 24, 2021, almost three years later. Coverage says the former employee has since been charged with a criminal HIPAA violation.
Sources checked: businesswire.com, ocrportal.hhs.gov, techtarget.com
Last verified against the official page:
What was exposed
The hospital's notice says the employee may have seen names, dates of birth, addresses, phone numbers, medical record numbers, diagnoses, medications and lab results. It said it had no evidence that Social Security numbers, insurance details or payment information were accessed.
No data was reported as leaked online. The risk is more personal: sensitive health details seen by someone who may know the patient. Scammers can also misuse a name tied to a diagnosis or medication.
The hospital's response
The hospital offered affected patients one year of free identity theft protection, and said it would tighten access controls and train staff.
What to do if you were in it
- 1
Read your insurance statements
Check explanation of benefits statements and bills for care you didn't receive, and tell your insurer or provider if something looks wrong.
- 2
Expect messages that mention the breach
Don't click links in emails or texts about the breach or offering help with it. Go to the organization's site yourself or call the number on your own records.
- 3
Take the free protection offered
If you got a letter with an enrollment code, use it. The FTC recommends accepting free credit monitoring when a company offers it.
- 4
Ask for your access history
Under HIPAA you can ask a provider for a list of disclosures of your records. Contact the hospital's privacy office if you want to know who looked.
- 5
Check which other breaches include your details
Run a free Serus scan to see whether your email or phone appears in this or other breaches. Serus can't remove breach data, but it alerts you when your details turn up so you know when to act.
Official filings
- U.S. Department of Health and Human Services , filed 24 Nov 2021 : 12,925 people
Timeline
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Huntington Hospital breach?
The hospital mailed letters on November 24, 2021 to the 12,925 people whose records were accessed. If you didn't get one, you were probably not included. You can confirm with the hospital's privacy office.
What was exposed?
Names, dates of birth, addresses, phone numbers, medical record numbers, diagnoses, medications and lab results, per the notice. Social Security numbers and payment details were not reported as accessed.
Why did notification take so long?
The hospital said law enforcement asked it to delay so as not to interfere with the investigation.
Should I freeze my credit?
The hospital reported no Social Security numbers were accessed, so it's optional. A freeze is free if you want one.
Sources
- businesswire.com/news/home/20211124006159/en/Huntington-Hospital-Notice-of-Unauthorized-Access-to-Personal-Information
- ocrportal.hhs.gov/ocr/breach/breach_report.jsf
- techtarget.com/healthtechsecurity/news/366595000/Former-NY-Hospital-Employee-Charged-with-HIPAA-Violation
- consumer.ftc.gov/consumer-alerts/2022/10/have-you-been-affected-data-breach-read
Something wrong or out of date? Tell us and we'll re-check it.
