Yale New Haven Hospital ynhhs.org Yale New Haven Hospital data breach: what happened and what to do
A file with the details of 19,496 Yale New Haven Hospital patients sat on a public page of the hospital's website from December 2021 to April 2022. It held names, phone numbers, email addresses and treatment details. It was a mistake, not a hack.
View all 13,115 breaches- Breach date
- 16 Dec 2021
- Made public
- 17 Jun 2022
- Affected
- 19,496
- Data exposed
- Names, Phone numbers, Email addresses, Treatment information
- Last updated
What happened
Yale New Haven Hospital says a research file with patient radiology information was uploaded to a public-facing part of its website by mistake. According to the hospital's announcement, the file was reachable from December 16, 2021 until April 18, 2022. Coverage describes it as human error, not a cyberattack.
The hospital told the U.S. Department of Health and Human Services (HHS) that the file covered 19,496 people. HHS lists the report date as June 17, 2022.
What was exposed
HHS's description says the file held names, telephone numbers, email addresses, diagnoses and other treatment information. The hospital's announcement says it did not include Social Security numbers or financial information.
That mix matters. A name, a phone number and a procedure type are exactly what a scammer needs for a convincing call or text: "this is about your recent imaging appointment." Expect that kind of message, and don't give anything to a caller who contacts you first.
The hospital's response
The hospital notified HHS, the people affected and the media. It also tightened its administrative, technical and security safeguards and retrained staff on protecting health information.
The hospital said the file may have been seen by only a small number of people. Nobody can say who downloaded a copy while it was public, so treat the data as exposed.
What to do if you were in it
- 1
Be wary of calls and texts about your care
Messages that mention your hospital, an appointment or a scan may be scams. Hang up and call the number on your bill or the hospital's website yourself.
- 2
Read your insurance statements
Check explanation of benefits statements for treatment you didn't receive. Report anything odd to your insurer.
- 3
Watch for phishing to your email
Don't click links in emails that mention this breach. Go to the hospital's site directly.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak.
Frequently asked
Was I affected by the Yale New Haven Hospital breach?
The hospital says it notified the people whose information was in the file. If you got a letter, you were affected. If you think you should have one, contact the hospital directly.
Were Social Security numbers exposed?
The hospital's announcement says no Social Security numbers or financial information were in the file.
Was this a hack?
No. Coverage describes a file uploaded to a public part of the website by mistake.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
