Breach, Data Security

Former Jacobi Medical Center employee improperly emails patient data


During the same assessment that revealed a recent Bellevue Hospital Center breach, New York City Health and Hospitals Corporation (HHC) identified a separate incident involving a former Jacobi Medical Center employee improperly emailing personal information on roughly 90,000 patients.

How many victims? About 90,000.

What type of personal information? Names, addresses, dates of birth, telephone numbers, medical record numbers, treatment dates and types of services, limited sensitive health information, and health insurance identification numbers, which may include Social Security numbers.

What happened? A former Jacobi employee improperly accessed and transmitted files containing the personal information to a personal email account and the email account at her new employer, which is a New York City agency.

What was the response? HHC interviewed the former employee, and confirmed that the email and information was deleted from her personal computer and personal email account, as well as the computer and email account used at her new employer. Steps have been taken to prevent former employees from gaining access to personal information once their employment has ceased. An automatic blocking system is being implemented to prevent email communications containing personal and other confidential information from being sent from HHC's systems to outside systems, unless for legitimate purposes. All potentially impacted individuals are being notified, and offered a free year of credit monitoring services. 

Details: The incident occurred on Feb. 19 and was discovered on Feb. 27. The employee indicated that she sent the information in the event that in the future she had to respond to questions about her past work.

Quote: “There is no evidence to suggest that the subject files were received or viewed by anyone other than the former employee, and there is no evidence to suggest that the PHI contained in these files was misused or further disclosed in any manner,” according to a notification posted to the website.

Source:, “Notification of Possible Personal Health Information Disclosure,” April 28, 2015;, “Notification Regarding Your Personal Health Information,” April 28, 2015.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.