NY · HHS OCR reports
HIPAA breaches in New York
HIPAA breaches affecting 500 or more individuals reported to HHS OCR by covered entities listed in New York.
Reports
516
Individuals affected
42,558,825
Under investigation
44
Top type: Hacking/IT Incident
State breach notification law
N.Y. Gen. Bus. Law §§ 899-aa to 899-bb (Notification of Unauthorized Acquisition of Private Information; Data Security Protections (SHIELD Act)) (amended 2025)
Timing: 30 days New York requires businesses and persons to notify affected individuals in the most expedient
Read the New York data breach notification law summaryAll reports, newest first
Page 8 of 11. 516 reports.
| Covered entity | Entity type | Individuals | Submitted | Type of breach | Status |
|---|---|---|---|---|---|
| Personal Touch Home Aides of Baltimore, Inc. | Healthcare Provider | 804 | Jan 28, 2020 | Hacking/IT Incident | Archive (closed) |
| Village Senior Services Corporation d/b/a VillageCareMAX | Health Plan | 2,645 | Jan 24, 2020 | Hacking/IT Incident | Archive (closed) |
| Village Center for Care d/b/a VillageCare Rehabilitative and Nursing Center | Healthcare Provider | 674 | Jan 24, 2020 | Hacking/IT Incident | Archive (closed) |
| Equinox, Inc. | Healthcare Provider | 1,021 | Dec 6, 2019 | Hacking/IT Incident | Archive (closed) |
| Ivy Rehab Network, Inc. and its affiliated companies | Healthcare Provider | 125,000 | Nov 26, 2019 | Hacking/IT Incident | Archive (closed) |
| OmniSeq, Inc. | Healthcare Provider | 3,977 | Nov 21, 2019 | Hacking/IT Incident | Archive (closed) |
| The Brooklyn Hospital Center | Healthcare Provider | 26,312 | Nov 1, 2019 | Hacking/IT Incident | Archive (closed) |
| Roswell Park Comprehensive Cancer Center | Healthcare Provider | 584 | Oct 18, 2019 | Unauthorized Access/Disclosure | Archive (closed) |
| Fedcap Rehabilitation Services, Inc. | Healthcare Provider | 2,158 | Aug 29, 2019 | Hacking/IT Incident | Archive (closed) |
| Fire Department City of New York | Healthcare Provider | 10,292 | Aug 9, 2019 | Theft | Archive (closed) |
| Mount Sinai Hospital | Healthcare Provider | 33,730 | Aug 2, 2019 | Hacking/IT Incident | Archive (closed) |
| Laboratory of Dermatopathology | Healthcare Provider | 4,082 | Jul 25, 2019 | Hacking/IT Incident | Archive (closed) |
| Susan Marshall, M.D.,PC | Healthcare Provider | 774 | Jul 25, 2019 | Theft | Archive (closed) |
| Sunrise Medical Laboratories, Inc. | Healthcare Provider | 401,901 | Jul 15, 2019 | Hacking/IT Incident | Archive (closed) |
| CBLPath, Inc. | Healthcare Provider | 141,956 | Jul 15, 2019 | Unauthorized Access/Disclosure | Archive (closed) |
| Adirondacks ACO, LLC | Business Associate | 39,649 | Jul 2, 2019 | Hacking/IT Incident | Archive (closed) |
| Health Quest Systems, Inc. | Healthcare Provider | 372,043 | May 31, 2019 | Hacking/IT Incident | Archive (closed) |
| Broome County, New York | Healthcare Provider | 7,048 | May 31, 2019 | Hacking/IT Incident | Archive (closed) |
| Healthfirst | Health Plan | 1,811 | May 24, 2019 | Unauthorized Access/Disclosure | Archive (closed) |
| Independent Health Association, Inc. | Health Plan | 7,605 | May 8, 2019 | Unauthorized Access/Disclosure | Archive (closed) |
| LISA ROSE DURSO, M.D. PLLC | Healthcare Provider | 537 | Apr 22, 2019 | Hacking/IT Incident | Archive (closed) |
| People, Inc. | Healthcare Provider | 970 | Apr 19, 2019 | Hacking/IT Incident | Archive (closed) |
| ELENA MARIA BURUIANA PHYSICIAN P.C. | Healthcare Provider | 1,308 | Apr 18, 2019 | Hacking/IT Incident | Archive (closed) |
| DePaul | Healthcare Provider | 902 | Mar 27, 2019 | Hacking/IT Incident | Archive (closed) |
| Warby Parker Inc. (f/k/a JAND Inc. d/b/a Warby Parker) | Healthcare Provider | 197,986 | Dec 20, 2018 | Hacking/IT Incident | Archive (closed) |
| University of Vermont Health Network - Elizabethtown Community Hospital | Healthcare Provider | 32,470 | Dec 17, 2018 | Hacking/IT Incident | Archive (closed) |
| East End Disability Associates, Inc. | Healthcare Provider | 896 | Nov 20, 2018 | Hacking/IT Incident | Archive (closed) |
| Episcopal Health Services | Healthcare Provider | 218,055 | Nov 19, 2018 | Hacking/IT Incident | Archive (closed) |
| New York Oncology Hematology, P.C. | Healthcare Provider | 128,400 | Nov 16, 2018 | Hacking/IT Incident | Archive (closed) |
| SUNY Upstate Medical University | Healthcare Provider | 1,216 | Nov 9, 2018 | Unauthorized Access/Disclosure | Archive (closed) |
| Catholic Charities Neighborhood Services, Inc. | Healthcare Provider | 565 | Sep 7, 2018 | Hacking/IT Incident | Archive (closed) |
| United Methodist Homes | Healthcare Provider | 843 | Aug 31, 2018 | Unauthorized Access/Disclosure | Archive (closed) |
| Ruben U. Carvajal, MD | Healthcare Provider | 3,775 | Jul 17, 2018 | Hacking/IT Incident | Archive (closed) |
| Central New York Cardiology | Healthcare Provider | 824 | Jul 13, 2018 | Loss | Archive (closed) |
| Med Associates, Inc. | Business Associate | 276,057 | Jun 14, 2018 | Hacking/IT Incident | Archive (closed) |
| New York City Human Resources Administration/Department of Social Services | Health Plan | 2,078 | May 11, 2018 | Unauthorized Access/Disclosure | Archive (closed) |
| Capital District Physicians’ Health Plan | Health Plan | 839 | Apr 20, 2018 | Unauthorized Access/Disclosure | Archive (closed) |
| Middletown Medical P.C. | Healthcare Provider | 63,551 | Mar 29, 2018 | Unauthorized Access/Disclosure | Archive (closed) |
| New York City Health and Hospitals Corporation - Harlem Hospital | Healthcare Provider | 595 | Mar 29, 2018 | Theft | Archive (closed) |
| The Arc of Erie County | Healthcare Provider | 3,751 | Mar 9, 2018 | Unauthorized Access/Disclosure | Archive (closed) |
| St. Peter's Ambulatory Surgery Center LLC - d/b/a St. Peter's Surgery & Endoscopy Center | Healthcare Provider | 134,512 | Feb 28, 2018 | Hacking/IT Incident | Archive (closed) |
| NYU School of Medicine - Pediatric Surgery Associates | Healthcare Provider | 2,158 | Dec 15, 2017 | Improper Disposal | Archive (closed) |
| Pharmacy Innovations | Healthcare Provider | 1,205 | Dec 12, 2017 | Hacking/IT Incident | Archive (closed) |
| Shop-Rite Supermarkets, Inc. | Healthcare Provider | 12,172 | Nov 3, 2017 | Improper Disposal | Archive (closed) |
| Catholic Charities of the Diocese of Albany | Healthcare Provider | 4,624 | Oct 27, 2017 | Hacking/IT Incident | Archive (closed) |
| Orthopedics NY, LLP | Healthcare Provider | 2,493 | Oct 12, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Amida Care | Health Plan | 6,231 | Sep 29, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| MetroPlus Health Plan, Inc. | Health Plan | 15,212 | Sep 1, 2017 | Unauthorized Access/Disclosure | Archive (closed) |
| Kaleida Health | Healthcare Provider | 744 | Aug 25, 2017 | Hacking/IT Incident | Archive (closed) |
| MJHS Home Care | Healthcare Provider | 8,413 | Aug 11, 2017 | Hacking/IT Incident | Archive (closed) |
Source: HHS OCR Breach Portal, OCR export October 2026.