NYC Health + Hospitals reports 1.8 million records compromised in hacking incident
New York City Health and Hospitals Corporation filed a breach notification with HHS OCR on March 24, 2026, reporting that a hacking/IT incident exposed the protected health information of 1.8 million individuals. The unauthorized access occurred on a network server. As a healthcare provider and covered entity, the organization is required to report breaches affecting 500 or more individuals to HHS within 60 days of discovery. This filing date reflects when the report was submitted to the government, not necessarily when the breach occurred or was discovered. Healthcare administrators should monitor for further details regarding the specific data types involved and any potential impact on shared systems or business associates.