Hospital for Special Surgery (“HSS”) is issuing this statement to inform its patients of a recent incident that may affect the security of protected health information. HSS considers it an honor and a privilege to care for our patients and their families. Protection of patient information remains one of our highest priorities and we sincerely regret this incident has occurred.
On May 31, 2013, HSS was advised by the New York County District Attorney’s Office (the “DA”) that the DA was conducting an ongoing criminal investigation related to potential credit card fraud. The DA explained that this matter was to be kept private and confidential, as this was an ongoing criminal investigation involving an HSS employee. HSS cooperated with law enforcement. Law enforcement instructed HSS not to investigate the matter independently or notify any affected individuals, until an arrest of the appropriate suspect had been made. An HSS employee who the DA believed was responsible for the unauthorized activity related to credit card information has been arrested and charged with grand larceny and identity theft.
HSS then commenced its own investigation into the incident, to determine the identities of individuals whose personal and/or health information may have been accessed by this employee without authorization. HSS retained privacy and data security legal counsel to assist with its investigation of, and response to, this incident. Although these investigations are ongoing, there is a possibility that this employee may have accessed personal and protected health information, including name, address, credit card information, and in some cases Social Security number, driver’s license number, email address, passport identification number, date of birth, bank account number, routing number, treating physician name, diagnosis information, medical billing/procedure information, responsible party name, responsible party personal information, responsible party payment information, insurance carrier name, and insurance policy number. This employee, in the course of employment, did have authorized access to patient files, and it has not been alleged that anything other than credit card information for a few individuals was used to commit actual fraud in any way.
HSS is steadfast in its commitment to the security of our patients’ information. HSS is providing written notice of this incident to each affected individual, to the U.S. Department of Health and Human Services, as well as to certain state and international regulators. HSS is offering affected individuals who have a U.S. Social Security number with access to one free year of credit monitoring services provided by AllClear. HSS is also undertaking a review of its internal data collection, access, and use policies and procedures.
HSS established a confidential inquiry line, staffed with professionals trained in identity theft and credit protection and restoration, and familiar with this incident. This confidential inquiry line is available Monday through Friday, 9:00 a.m. to 12:00 a.m. E.S.T. at 855.770.0004 (U.S. and Canadian residents) or +1.814.201.3684 (International residents). You can also contact us with any questions by email at firstname.lastname@example.org. Please only provide your name and phone number in your email. Please provide reference number 842102013 when calling.