Attorney General James Secures $500,000 from Capital Region Health Care Provider for Failing to Protect Patients’ Information

New York Attorney General Letitia James announced that her office has secured $500,000 in penalties from OrthopedicsNY, LLP for failing to protect patients’ private information, with the health care practice serving the Capital Region. An investigation by the Office of the Attorney General found that cyber-attackers were able to steal data because the practice did not properly protect its systems, exposing the information of more than 650,000 patients and employees.

In 2023, attackers gained remote access using compromised login information and downloaded unencrypted files containing sensitive personal and health data for approximately 656,000 individuals, including about 110,000 with social security, driver’s licence, or passport numbers.

The settlement requires OrthopedicsNY to pay $500,000 and to strengthen data security, including multi-factor authentication for remote access, encryption of data, and annual risk assessments, while offering one year of free credit monitoring to impacted individuals. The announcement also notes ongoing monitoring and the adoption of a comprehensive information security programme to safeguard patient data, according to Office of the Attorney General (OAG).