NEW JERSEYHackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedPHIHealth (basic)Identity (basic)Government IDHighContained

Diamond Institute for Fertility and Menopause, LLC

bd_013e297b5a3d0cc7 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 27, 2017

Filed

Apr 28, 2017

To disclose

9 weeks

Affected

14,633

Linked

3 filings

Confidence

67%

Full breach record for Diamond Institute for Fertility and Menopause, LLC →

Diamond Institute for Fertility and Menopause, LLC reported to HHS on 2017-04-28 a Hacking/IT Incident affecting 14633 individuals. Breached information located on Network Server. An unknown individual used a doctor's login credentials to access patient ePHI (demographics, lab results, SSNs). The CE disabled the account, replaced hardware, and terminated its BA.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time9 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 9 weeks / 60 days

Feb 27, 2017

Begins

Feb 27, 2017

Discovered

Apr 28, 2017

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_0f971e8471edb2ac2017-04-28Verified
Massachusetts State AGbd_614ee689b35c15582017-04-28Verified

Name: Diamond Institute for Fertility and Menopause, LLC
norm: diamond institute for fertility and menopause
Industry: Health Care Services

Name: Diamond Institute for Fertility and Menopause, LLC
norm: diamond institute for fertility and menopause
Industry: Healthcaresource default

Discovered: Feb 27, 2017
Breach occurred: Feb 27, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 14,633nationwide
Data types: PHIHealth (basic)Identity (basic)Government ID
HHS breach type: Hacking / IT incident
Where the data lived: Network server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: provided timely breach notification to HHSOCR obtained assurances that the CE implemented the corrective actions listed
Initial access: valid_credentials

During the incident: Disabled the compromised account
Forced the intruder off its systems
Purchased a new firewall
Replaced the server and several workstations
Improved password protocols
Terminated its business associate (BA) responsible for safeguarding its ePHI and hired a new BA
Changes made: Perform a risk analysis
Establish a risk management plan
Document the unauthorized disclosure of its patients’ ePHI for accounting of disclosure purposes
Execute agreements with BAs
Perform a technical and non-technical evaluation in response to environmental or operational changes
Implement access controls and valid encryption processes
Develop policies and procedures and train all of its workforce members regarding the Breach Notification Rule’s requirements
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Feb 27, 2017
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Feb 27, 2017
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Feb 27, 2017 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Feb 27, 2017 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGApr 28 · first

Massachusetts State AGApr 28 · first

HHS OCRApr 28 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 28, 2017
Raw hash: e6c9501c6ba2fb33eaa3cb9611fa4aba13188335688229a73a3ca5f543a93c3b

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.5 KB

Download View at source

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityDiamond Institute for Fertility and Menopause, LLC

Victim entityDiamond Institute for Fertility and Menopause, LLC

Incidentdiscovered Feb 27, 2017

Stated responseDisabled the compromised account

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing