Almeida Law Group is investigating a data breach at NewYork-Presbyterian Hospital. If you were affected, contact Almeida Law Group.
About NewYork-Presbyterian Hospital
NewYork-Presbyterian Hospital (NYP) is a nonprofit academic medical center based in New York City, operating multiple campuses across New York City, Long Island, Westchester County, and New Jersey. It serves as the primary teaching hospital for Weill Cornell Medicine and Columbia University College of Physicians and Surgeons, with more than 2 million patient visits annually. Because NYP is a healthcare provider, the records it handles are subject to HIPAA protections.
What Happened?
NewYork-Presbyterian Hospital was listed in an HHS Office for Civil Rights breach portal report submitted on June 16th, 2026. The incident was classified as an Unauthorized Access/Disclosure involving Paper/Films, and no business associate was involved. A total of 6,909 individuals were affected. Because the breached information was located in Paper/Films rather than electronic systems, this incident likely involved physical records — such as misdirected paper documents, improperly disposed files, or unauthorized access to physical patient records or imaging films — rather than a cyberattack. The specific data types exposed were not reported.
NYP has a notable history of HIPAA enforcement actions. In 2014, the hospital paid a $3.3 million HIPAA settlement (alongside a $1.5 million settlement by Columbia University) after approximately 6,800 patients’ electronic protected health information was found publicly accessible on the internet due to a misconfigured server. In 2016, NYP paid a $2.2 million HIPAA settlement for allowing a television crew to film patients without authorization. In 2023, NYP reported a 54,396-record breach related to website tracking pixels that impermissibly shared patient information with third-party service providers, which led to a $300,000 settlement with the New York Attorney General in late 2024. No public litigation or class actions specifically tied to this June 2026 Paper/Films breach have been reported.
Key Facts at a Glance
- Company or Organization: NewYork-Presbyterian Hospital
- Industry: Healthcare Provider — Nonprofit Academic Medical Center
- Location: New York, NY (multiple campuses across New York City, Long Island, Westchester County, and New Jersey)
- Incident type: Unauthorized Access/Disclosure
- Total persons affected: 6,909
- Prior breach: Yes — multiple prior HIPAA enforcement actions and settlements (2014, 2016, 2023/2024)
- Source: HHS Office for Civil Rights breach portal report; HHS.gov — 2014 HIPAA Settlement; HHS.gov — 2016 HIPAA Settlement; HIPAA Journal — 2023 Pixel Tracking Breach; HIPAA Journal — NY AG Pixel Settlement
What Should You Do?
If you received a notice from NewYork-Presbyterian Hospital about this incident, review it carefully for any identity protection enrollment offer and sign up before the deadline. Even if no enrollment offer was made, consider placing a fraud alert or credit freeze with the three major credit bureaus — Equifax, Experian, and TransUnion — and monitor your financial accounts and credit reports for any unusual activity. You can request free annual credit reports at AnnualCreditReport.com. Because this incident occurred at a healthcare provider, also review your Explanation of Benefits statements and medical records for any services you did not receive, and report any suspected identity theft or medical identity theft at IdentityTheft.gov.
Your Legal Rights
If your personal or health information was involved in this breach, you may have legal rights depending on the facts of the incident and the law in your state. Almeida Law Group represents consumers in data breach and privacy litigation and can help you evaluate whether you may have a claim. Contact us at (708) 529-5418 or through our contact page for a free case evaluation.
