Montefiore Medical Center agreed to pay $4.75 million to settle allegations by the Department of Health and Human Services’ Office for Civil Rights (HHS OCR) that failures by the New York City nonprofit facility allowed an employee to steal and sell patient information for six months.

The medical center engaged in multiple data security shortcomings that violated the Health Insurance Portability and Accountability Act (HIPAA), including failing to safeguard patient medical information, conduct risk assessments of the security of the medical data in its files, and carry out policies and procedures that monitored access and activity to the information, the OCR said Tuesday in a press release.

The alleged failures came to light after the hospital was contacted by police in May 2015 about possible data theft of a particular patient’s medical information. Montefiore investigated and found that, two years earlier, an employee had stolen the medical information of 12,517 patients and sold that info to an identity theft ring, per the OCR. The hospital then filed a breach report with the regulator.