NYP and Columbia let one server change put patient data on Google

NewYork-Presbyterian Hospital and Columbia University shared a network and firewall around patient data. In 2010 a Columbia physician tried to deactivate a personally owned computer server connected to that environment.

Because technical safeguards were inadequate, electronic protected health information for 6,800 people became accessible through internet search engines. The data included medications and test results, according to HIPAA Journal.

HHS OCR settled with both organizations in 2014: NYP paid $3.3 million and Columbia paid $1.5 million. The case turned a routine server retirement into a record HIPAA settlement because neither side had adequately mapped and risk-managed the shared system.

$4.8 million in HIPAA settlements: $3.3 million from NYP and $1.5 million from Columbia after 6,800 patients' ePHI was exposed.

The affiliated institutions shared infrastructure without enough technical separation around patient records.

A local server deactivation was allowed to affect exposure of data in the broader clinical network.

OCR alleged that both organizations lacked adequate risk analysis and risk management plans.

Search-engine discovery made the privacy failure visible to patients and regulators.

Shared networks need shared change control; one local server action can expose another institution's records if boundaries are only assumed.

Both organizations accepted corrective action obligations after the 2014 settlement. The incident remains a useful warning for joint ventures and academic medical centers: shared infrastructure needs explicit ownership, asset inventory and change review.