ARTIFICIAL INTELLIGENCE [AI] IS NOT USED, IN WHOLE OR IN PART, IN PREPARING NYPPL SUMMARIES OF JUDICIAL AND QUASI-JUDICIAL DECISIONS

October 07, 2023

Cyber attacks on State, local government and school district cyber security systems

In a report issued in October 2023, New York's State Comptroller Thomas P. DiNapoli indicated that:

"Cyberattacks are a serious threat to America’s critical infrastructure and have the potential to severely impact our day-to-day lives. These incidents often result in data breaches for companies and institutions that collect large amounts of personally identifiable data. Data breaches expose New Yorkers to invasions of privacy, the possibility of identity theft and other types of fraud. Even more troubling are incidents such as ransomware or distributed denial of service attacks that have the potential to shut down systems that we rely on for water, power, health care and other necessities."

The report highlights the recent proliferation of cyberattacks, details the most common types; discusses recent efforts to respond to and prevent such attacks; and recommends a policy framework intended to help New York stay ahead of the threat presented by cyberattacks. 

The Office of the State Comptroller [OSC] noted that it is working to help avoid cyber attacks by auditing and uncovering weaknesses in State, local government and school district cyber security systems. Audits by OSC's Divisions of State Government Accountability and Local Government and School Accountability revealed dozens of ransom ware attacks and other data breach incidents that compromised New York State agencies, counties, cities, towns and villages, hospitals and public-school systems, and have identified gaps in cyber security. OSC said "Understanding and addressing these weaknesses can help New York State remain vigilant."

OCS noted that it "will continue to dedicate attention and resources to protecting New York residents and institutions from these attacks."

Click HERE to access the State Comptroller's October 2023 report.

 

October 06, 2023

Substantial evidence

The determination of appointing authority [Employer] which terminated Petitioner's employment based on the report and recommendation of an Administrative Law Judge was unanimously confirmed by the Appellate Division. 

The court noted that "Substantial evidence supports [the Employer's] determination that Petitioner violated Department directives and procedures concerning the retrieval of inmate property, engaged in undue familiarity with an inmate, failed to submit a required unusual incident report, used excessive force against an inmate, and made false and misleading statements.] 

Under the circumstances the Appellate Division opined that "The penalty of termination of petitioner's employment does not shock one's sense of fairness", citing Matter of Pell v Board of Educ. of Union Free School Dist. No. 1 of Towns of Scarsdale & Mamaroneck, Westchester County, 34 NY2d 222, among other decisions.

Click HERE to access the Appellate Division's decision posted on the Internet.

 

Employee's application seeking a religious exemption from the COVID-19 vaccination requirement for agency employees denied

The Appellate Division sustained Supreme Court's decision rejecting Plaintiff's petition seeking a court order annulling the determination of the City of New York Reasonable Accommodation Appeals Panel [Citywide Panel] denying Plaintiff's request for a religious exemption from the COVID-19 vaccination requirement for employees of the New York City Department of Education [DOE].

The Citywide Panel denied Plaintiff's administrative appeal challenging the denial of his application for a religious exemption from the vaccination requirement, finding that:

[1] "Plaintiff failed to establish that his objection to receiving any of the COVID-19 vaccines was based on a sincerely held religious belief; and 

[2] "granting the accommodation would impose an undue hardship on DOE."

Citing Matter of Marsteller v City of New York, 217 AD3d 543, the Appellate Division noted that Plaintiff:

[1] "had no demonstrated history of refusing medications or vaccines;

[2] "he admitted to receiving a certain vaccination required for him to attend college;  and 

[3] "he refused to answer a question about whether he had avoided any other vaccines or medications based on the same objection he raised to the COVID-19 vaccines."

The court also rejected Plaintiff's argument that DOE's "Position Statement" was unsigned and undated hearsay, noting "Generally, administrative proceedings need not conform to all of the ... evidentiary rules adhered to in judicial tribunals", citing Matter of Church of Scientology of N.Y. v Tax Commn. of City of N.Y., 120 AD2 376, nor need an agency "state with specificity its detailed analysis," or "point to any contemporaneously created record that demonstrates that it considered all relevant factors" or "or engage in a cooperative dialogue".

Click HERE to access the Appellate Division's decision posted on the Internet.

 

October 05, 2023

New York State Comptroller Thomas P. DiNapoli released audits of State entities

On October 4, 2023, State Comptroller Thomas P. DiNapoli announced the audits of State Departments, Agencies, Public Authorities and other entities listed below were issued.

Click on the text highlighted in color to access both the summary and the complete audit report

 

Metropolitan Transportation Authority – New York City Transit: Risk Assessment and Implementation of Measures to Address Extreme Weather Conditions (2021-S-27)

Flooding remains a serious issue for the City and the Metropolitan Transportation Agency’s (MTA) transportation system, including New York City Transit (Transit). In September 2007, the Chair of the MTA appointed a commission to make sustainability-related recommendations to the MTA and its agencies. The audit found that, to date, the MTA has not implemented one of the most important recommendations – the development of the climate change adaptation master plan. Further, review of a sample of capital projects intended to correct or prevent damage found that projects were often incomplete in scope of work, not finished on time or within budget, or insufficiently documented.

 

Department of State – Implementation of the Security Guard Act (Follow-Up) (2023-F-20)

Article 7-A of the General Business Law, also known as the Security Guard Act (Act), requires that individuals working as security guards have a valid registration card and entrusts the Department of State (DOS) with issuing registration cards. The Act also requires guards to complete training and renew their registration every 2 years. A prior audit, issued in July 2021, found security guards classified as police/peace officers did not fulfill their training requirements, including armed guards who did not complete the required firearms training. The follow-up found DOS made significant progress in addressing the problems identified in the initial audit report, implementing a new procedure for monitoring and reviewing training records. Of the initial report’s four audit recommendations, three were fully implemented and one was partially implemented.

 

Department of Transportation – Compliance With Freedom of Information Law Requirements (2020-S-12)

The New York Freedom of Information Law (FOIL) provides for public access to government records. Under FOIL, agencies, including the Department of Transportation (DOT), must make all eligible records available for public inspection or copying upon request. The audit found DOT did not always comply with the FOIL requirements, identifying instances of non-compliance, including cases of DOT not providing the requested records available, denying the request, or failing to acknowledge the request within the statutory time frame. Furthermore, DOT obstructed the audit by, among other actions, requiring that all meetings be attended by supervisory staff from DOT’s main office and not providing all requested information.

 

New York Power Authority – Selected Management and Operations Practices: BuildSmart NY/Executive Order 88 (2023-S-27)

BuildSmart NY is a program created to carry out Executive Order 88 (EO 88), which mandated a 20% improvement in the energy efficiency performance of State government buildings by April 2020 and the BuildSmart 2025 program expands upon the original program and sets new objectives equivalent to a 34% reduction in energy usage. The New York Power Authority (NYPA) administers EO 88 and organizations subject to EO 88 (Affected State Entities [ASEs]) work with NYPA to achieve their allotted portion of the overall savings targeted by 2025. NYPA’s Final Report shows the actual reduction reported was 14.4% by April 2020, and when committed projects (incomplete) are added, the reduction is 22.6%. However, the report includes 123 projects of 158 that are not scheduled to be completed until as late as 2024. Additionally, when NYPA annually reported the status of the BuildSmart NY program, officials shied away from identifying the deficiencies in ASE non-compliance and instead asserted that they had no ability to enforce EO 88.

 

State Education Department – Adult Career and Continuing Education Services: Vocational Rehabilitation Supported Employment Program (Follow-Up) (2023-F-15)

The State Education Department’s (SED) Adult Career and Continuing Education Services – Vocational Rehabilitation (ACCES-VR) program provides vocational rehabilitation services for and supports the employment goals of people with a disability. To help program participants achieve and maintain employment, counselors develop an Individualized Plan for Employment (IPE) with each participant, which identifies the employment goal, services that will be provided to help achieve that goal, and how progress will be measured. A prior audit, issued in March 2022, found that SED did not always meet the time frames for eligibility determinations or finalization and annual reviews of IPEs and SED did not provide any documented evaluations to show the ACCES-VR program was being adequately monitored. The follow-up found SED made progress addressing the issues identified in the initial audit report, replacing its case management system to allow for improved oversight and developing step-by-step guidance for counselors completing IPEs. Of the initial report’s three recommendations, two were implemented and one was partially implemented.

 

State Education Department – Oversight of Mental Health Education in Schools (Follow-Up) (2023-F-21)

Under Section 804 of the Education Law (Law), the State Education Department (SED) is responsible for enforcing a requirement for mental health education in schools. An initial audit, issued in April 2022, found that mental health teams at many school districts were understaffed and that SED did not require school districts to submit any documentation indicating compliance with the Law. SED made progress in addressing the problems identified in the initial audit report, developing a mechanism to determine if schools are providing mental health education and taking steps to secure more mental health staffing. Both recommendations from the initial report were implemented.

 

New York City Office of Technology and Innovation – LinkNYC Program Revenues and Monitoring (Follow-Up) (2022-F-25)

New York City’s Office of Technology and Innovation (OTI) procures citywide IT services. In December 2014, NYC entered into a Franchise Agreement (Agreement) with a consortium of technology, media, and connectivity providers (Consortium) to replace aging public pay telephones with state-of-the-art connection points called Links that would offer free Internet access and phone service. A prior audit issued in July 2021 found that OTI did not sufficiently monitor and enforce the Consortium’s compliance with the Agreement terms, including the collection of almost $70 million due to NYC. The follow-up found that OTI made progress in addressing these issues, but it could do more to ensure revenues owed are assessed and collected correctly and Links are properly installed and maintained. Of the initial report’s 18 recommendations, seven were implemented, six were partially implemented, and five were not implemented.

 

Medicaid Program – Recovering Managed Care Payments for Inpatient Services on Behalf of Recipients With Third-Party Health Insurance (2021-S-24)

For Medicaid recipients enrolled in managed care, the Department of Health (DOH) pays managed care organizations (MCOs) a monthly premium for each enrolled recipient, and, in turn, the MCOs arrange for their health care services, including inpatient services. Many recipients have other third-party health insurance (TPHI) in addition to Medicaid. Medicaid is considered the payer of last resort, and, as such, MCOs are required to coordinate benefits with the recipient’s TPHI prior to paying for Medicaid services. The Office of the Medicaid Inspector General uses a contractor to identify and recover payments made for services that should have been paid for by a recipient’s TPHI. During the audit period, the contractor did not bill TPHI carriers or initiate provider reviews for the recovery of $52.2 million in inpatient claims where MCOs paid as the primary insurance despite recipients having TPHI inpatient coverage.

 

Department of Health: Medicaid Program – Improper Medicaid Payments for Claims Not in Compliance With Ordering, Prescribing, Referring, and Attending Requirements (Follow-Up) (2023-F-4)  

As of January 1, 2014, New York’s Medicaid program required health care professionals who order, prescribe, refer, or attend (OPRA) Medicaid services be appropriately screened and enrolled in Medicaid and their National Provider Identifier (NPI) – a unique identification number – to be included on Medicaid claims. A prior audit issued in August 2021 found Medicaid made over $1.5 billion in improper and questionable payments for claims that did not contain an enrolled or affiliated OPRA NPI as required or where the NPI was not properly validated by the Department of Health (DOH) at the time of payment, and $19.4 million in payments for claims that contained an OPRA NPI that should not be included on Medicaid claims or that should be further reviewed by DOH due to past misconduct. The follow-up found that none of the improper and questionable payments have been reviewed. Furthermore, DOH has not improved system controls to prevent improper use of an override option for pharmacy claims that were denied because they did not contain the NPI of an enrolled provider in the prescribing field, and, as a result, auditors identified another $11.3 million in improper pharmacy payments since the initial audit. Of the initial report’s 12 audit recommendations, one was implemented, three were partially implemented, and eight were not implemented.

 

New York State Health Insurance Program – UnitedHealthcare Insurance Company of New York: Overpayments for Physician-Administered Drugs (2021-S-32)

The Department of Civil Service contracts with UnitedHealthcare Insurance Company of New York (United) to administer the Medical/Surgical Program of the Empire Plan, which covers a range of services, including physician-administered drugs, which are also covered under the Empire Plan’s separate Prescription Drug Program. A physician-administered drug is an outpatient drug (other than a vaccine) that is usually administered by a health care provider in a physician’s office or other outpatient clinical setting. The audit identified $5,536,537 in actual and potential overpayments for the cost of physician-administered drugs during the audit period. As of March 29, 2023, United recovered $254,188 of the improper payments.

 

New York State Health Insurance Program – Empire BlueCross: Overpayments for Physician- Administered Drugs (2021-S-33)

The Department of Civil Service contracts with Empire BlueCross (Empire) to administer the Hospital Program of the Empire Plan, which covers services including physician-administered drugs. A physician-administered drug is a drug, other than a vaccine, that is typically administered by a health care professional in a hospital or facility setting. In certain circumstances, physician-administered drugs are paid under the Empire Plan’s separate Prescription Drug Program, but both programs should not pay for the same physician-administered drug for the same patient on the same date of service. The audit identified $2,776,510 in actual and potential overpayments for the cost of physician-administered drugs during the audit period. As of June 21, 2023, Empire had started recoveries for $116,287 of the improper payments.

 

Department of Civil Service – New York State Health Insurance Program: Incorrect Payments by CVS Caremark for Medicare Rx Drug Claims That Were Improperly Paid Under the Commercial Plan (2022-S-24)

The Department of Civil Service (Civil Service) contracts with CaremarkPCS Health, L.L.C. (CVS Caremark) to administer the prescription drug program for the Empire Plan, which includes the Empire Plan Medicare Rx drug plan (Medicare Rx Plan) for retired members and their dependents who have Medicare, and a Commercial Plan for members and their dependents who do not have Medicare. Claims paid under the Medicare Rx Plan are eligible for enhanced drug manufacturer discounts and federal subsidies that are not available for claims paid under the Commercial. For the audit period, auditors identified claims totaling $12,358,531 that were incorrectly paid under the Commercial Plan instead of the Medicare Rx Plan.

###

 

Cybercrime in New York Rises

Cyberattacks in New York state increased 53% between 2016 and 2022, jumping from 16,426 incidents in 2016 to 25,112 in 2022. The number of attacks targeting critical infrastructure in New York state nearly doubled to 83 in the first half of 2023 compared to 48 during the entirety of last year, according to a report released on October 5, 2023, by State Comptroller Thomas P. DiNapoli.

Estimated losses in New York from cyberattacks in 2022 totaled over $775 million, while losses nationwide totaled $10.3 billion.

“Cyberattacks are a serious threat to New York’s critical infrastructure, economy and our everyday lives,” said DiNapoli. “Data breaches at companies and institutions that collect large amounts of personal information expose New Yorkers to potential invasions of privacy, identity theft and fraud. Also troubling is the rise in ransomware attacks that can shut down systems we rely on for water, power, health care and other necessities. Safeguarding our state from cyberattacks requires sustained investment, coordination, and vigilance.”

Relative to other states, New York had the third highest number of ransomware attacks (135) and corporate data breaches (238) in 2022, trailing only California and Texas for ransomware attacks and California and Florida for corporate data breaches. New York also had the fourth-highest number of cybercrime victims in the nation in 2022 with losses skyrocketing 632% since 2016.

The two most attacked critical infrastructure sectors through ransomware and data breaches in New York were Healthcare and Public Health (9) and Financial Services (8). Commercial Facilities and Government Facilities (7) tied for third.

Combatting the Threat

Securing critical infrastructure from cyberattacks will require sustained investment, coordination and vigilance. In 2022, the Governor appointed a state chief cyber officer to lead cross-agency efforts to combat cyber threats and improve the state's critical infrastructure assets’ cybersecurity. The cyber chief leads a newly created Joint Security Operations Center, a multi-agency cybersecurity coordination hub linking New York state, New York City, local and regional governments and critical infrastructure stakeholders and federal partners for information sharing, cyber threat detection and incident response. In August, the Governor released the first statewide cybersecurity strategy, which will allow the state to access new federal funding.

The federal Cyber Incident Reporting for Critical Infrastructure Act of 2022, for which rules and regulations are being developed, will require cybersecurity reporting for critical infrastructure sectors. The creation of a centralized repository of data breach reports from across the critical infrastructure sectors would also aid in identifying new attack-vectors or exploits before they become widespread, and for coordinated responses to emerging cyberthreats. Encompassing local governments in this database would be important.

DiNapoli’s cybersecurity audits of state agencies and public authorities have found several common technical weaknesses and risks across its audits, such as entities’ misunderstanding of security risks, unsupported applications, unknown data on systems, poor access controls and a lack of monitoring of changes to systems, among others. Recommendations are provided to each agency to enable them to begin corrective actions immediately to strengthen their networks.

Cybersecurity Challenges Facing Local Governments and Schools

DiNapoli also released a report on the cybersecurity challenges facing New York’s local governments and school districts. In New York, cyberattacks have impacted local governments and schools both large and small, including reported attacks at counties including Albany, Chenango, Erie, Nassau, Schenectady, Suffolk, and Schuyler; cities including New York, Albany, Buffalo, Yonkers, Long Beach, and Olean; and towns including Brookhaven, Ulster, Canandaigua, and Moreau.

In 2019, a ransomware attack on the Syracuse City School District froze the district out of its own systems, crippling the website, email system, phones, and back-end functions like payroll and student management. Other attacks on local governments have had far reaching impacts. The September 2022 ransomware attack on Suffolk County, the ramifications of which the county is still dealing with, required the county to disable important computer systems and move many of the county’s functions back to pen and paper for months. It was a cautionary example of the potential impacts of a cyberattack, and highlighted the risk to state systems that linked local government systems could pose.

These and other recent events have demonstrated the serious risks that illegal access to these systems can pose to critical local government and school operations that rely heavily on technology. DiNapoli’s report provides guidance and resources for local governments and schools to help them manage the risks associated with cybersecurity.

Risks in Local Governments and School Districts

From 2019 through July 31, 2023, DiNapoli’s Local Government and School Accountability division released more than 190 information technology (IT) audits, finding more than 2,400 cybersecurity-related issues. The audits focused on breakdowns or gaps in fundamental cybersecurity components. The most common areas where improvement and corrective action were needed included cybersecurity governance aspects such as training in IT security awareness, policies and procedures, and the need for contingency plans. Because these cybersecurity audits are sensitive in nature, many findings and recommendations for corrective action are communicated confidentially to local government and school officials. Often the audit recommendations can be implemented at no or low cost to local governments or school districts.

Reports

Cyberattacks on New York’s Critical Infrastructure: Staying Ahead of the Threat

 
New York Local Government and School Cybersecurity: A Cyber Profile

 

CAUTION

Subsequent court and administrative rulings, or changes to laws, rules and regulations may have modified or clarified or vacated or reversed the information and, or, decisions summarized in NYPPL. For example, New York State Department of Civil Service's Advisory Memorandum 24-08 reflects changes required as the result of certain amendments to §72 of the New York State Civil Service Law to take effect January 1, 2025 [See Chapter 306 of the Laws of 2024]. Advisory Memorandum 24-08 in PDF format is posted on the Internet at https://www.cs.ny.gov/ssd/pdf/AM24-08Combined.pdf. Accordingly, the information and case summaries should be Shepardized® or otherwise checked to make certain that the most recent information is being considered by the reader.
THE MATERIAL ON THIS WEBSITE IS FOR INFORMATION ONLY. AGAIN, CHANGES IN LAWS, RULES, REGULATIONS AND NEW COURT AND ADMINISTRATIVE DECISIONS MAY AFFECT THE ACCURACY OF THE INFORMATION PROVIDED IN THIS LAWBLOG. THE MATERIAL PRESENTED IS NOT LEGAL ADVICE AND THE USE OF ANY MATERIAL POSTED ON THIS WEBSITE, OR CORRESPONDENCE CONCERNING SUCH MATERIAL, DOES NOT CREATE AN ATTORNEY-CLIENT RELATIONSHIP.
NYPPL Blogger Harvey Randall served as Principal Attorney, New York State Department of Civil Service; Director of Personnel, SUNY Central Administration; Director of Research, Governor’s Office of Employee Relations; and Staff Judge Advocate General, New York Guard. Consistent with the Declaration of Principles jointly adopted by a Committee of the American Bar Association and a Committee of Publishers and Associations, the material posted to this blog is presented with the understanding that neither the publisher nor NYPPL and, or, its staff and contributors are providing legal advice to the reader and in the event legal or other expert assistance is needed, the reader is urged to seek such advice from a knowledgeable professional.
New York Public Personnel Law. Email: publications@nycap.rr.com