$550K secured in cyber-security investigation of Hudson Valley healthcare facility operator

ALBANY, N.Y. (NEWS10)-- The N.Y. Attorney General's Office and HealthAlliance have reached an agreement in a cyberattack settlement from incidents in 2023. The healthcare facility operator is required to pay $550,000 for failing to properly protect the personal and medical information of its customers.

HealthAlliance operates facilities in Ulster and Delaware Counties, including hospitals in Kingston and Margaretville and a care center in Margaretville. According to the OAG, an investigation found that the HealthAlliance did not address an issue within its system, leading to a cyber-attack that compromised the personal and medical information of 242,641 patients.

In July 2023, a vendor for the company's web applications issued a cybersecurity alert and suggested the company take action. Due to reported technical issues, the HealthAlliance did not fix the issue and continued to work with the vulnerability in their systems.

The cyber-attackers were able to access and steal patient's names, addresses, Social Security numbers, diagnoses, lab results, and medical and other financial information between September and October 2023. In response, the company replaced its devices with new ones.

"HealthAlliance provides essential health care services to New Yorkers, but it also has a responsibility to protect private medical information as part of its patient care,” said Attorney General James. “No one should have to worry that when they seek medical care, they are putting their private information in the hands of scammers and hackers. Every company that is entrusted by New Yorkers with personal information, especially financial and medical data, must take necessary precautions to ensure their systems are not vulnerable to cyberattacks."

The company originally agreed to pay $1.4 million in penalties, $850,000 of which will be suspended due to the company's financial condition and its role in providing health care in underserved areas. HealthAlliance also agreed to adopt a series of procedures designed to strengthen its cybersecurity practices moving forward, including:

• Maintaining a comprehensive information security program designed to protect the security, confidentiality, and integrity of private information; 
• Developing and maintaining data inventory to ensure all private information is stored in accordance with data security and privacy policies, including appropriate encryption;
• Maintaining and enforcing a patch management policy that requires that critical vulnerabilities are patched within 72 hours or that the associated vulnerability is neutralized; and 
• Adopting a series of additional security measures to restrict and monitor network activity.

In January, the OAG reached an agreement with another Hudson Valley health care provider to invest in $1.2 million to protect patient data, as well. The agreement was handled by Assistant Attorney General Marc Montgomery and Deputy Bureau Chief Clark Russell, under the supervision of Bureau Chief Kim Berger of the Bureau of Internet and Technology.