New York City Health & Hospitals Corporation

The covered entity (CE), New York City Health & Hospitals, discovered 198 boxes containing protected health information (PHI) in an employee parking garage of one of its facilities. The PHI included 10,058 patients’ names, addresses, dates of birth, social security numbers, financial information, diagnostic information, and other treatment information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, OCR conducted an investigation, and the CE relocated the boxes containing PHI to a private storage facility, revised its records management policies, retrained its workforce on its HIPAA practices, and implemented additional facility inspections to monitor compliance with its HIPAA Privacy and Security policies.