Cybersecurity Policy Report, N.Y. Health Care Operator Settles Claims Alleging Security Failures, (Dec 9, 2024)

By Tony Foley

New York Attorney General Letitia James (D.) today announced that her office had secured a settlement of $550,000 against Hudson Valley health care facility operator HealthAlliance for its failure to properly protect the personal and medical information of its patients, leading to a 2023 data breach.

In her announcement, AG James said an investigation found that HealthAlliance did not address a weakness in its systems identified by one of its vendors, resulting in a cyber attack that compromised the data of nearly a quarter million New Yorkers. The vendor for the health care provider’s web applications released a cyber alert in July 2023 that instructed its clients to take action to patch a vulnerability in their systems, but due to a technical issue, HealthAlliance was not able to install the patch, and rather than taking the system offline, continued to operate it with the vulnerability as it worked to fix the issue.

Between September and October 2023, cyber attackers exploited the vulnerability and stole sensitive information, including patient records and employee information. An internal forensic investigation by HealthAlliance found that the attackers were able to exfiltrate data including names, addresses, dates of birth, Social Security numbers, and other sensitive data.

“HealthAlliance provides essential health care services to New Yorkers, but it also has a responsibility to protect private medical information as part of its patient care,” AG James said. “No one should have to worry that when they seek medical care, they are putting their private information in the hands of scammers and hackers. Every company that is entrusted by New Yorkers with personal information, especially financial and medical data, must take necessary precautions to ensure their systems are not vulnerable to cyberattacks.”

Under an assurance of discontinuance, Health Alliance agreed to pay a fine of $1.4 million, reduced by $850,000 due to the company’s financial condition and its role in providing essential health care services to New Yorkers in underserved areas. In addition, HealthAlliance must adopt a series of procedures to strengthen its cybersecurity practices going forward, including maintaining a comprehensive information security program, developing and maintaining a data inventory to ensure that all private information is stored in accordance with best practices, including encryption, maintaining and enforcing a patch management policy, and adopting other specified security measures to restrict and monitor network activity.

News: StateLegislation LitigationEnforcement DataSecurity DataBreach DataPrivacy