ARIZONAPhysicalHealthcareHealthcareTheftCustomer Data InvolvedPHIHealth (basic)Identity (basic)Government IDFinancial accountHighResolved

Echo Canyon Healthcare, Incorporated dba Heritage Court Post Acute of Scottsdale

bd_028ddb8b6835382f · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 22, 2018

Filed

May 21, 2018

To disclose

9 weeks

Affected

1,765

Confidence

68%

Full breach record for Echo Canyon Healthcare, Incorporated dba Heritage Court Post Acute of Scottsdale →

Echo Canyon Healthcare, Incorporated dba Heritage Court Post Acute of Scottsdale reported to HHS on 2018-05-21 a Theft affecting 1,765 individuals. Breached information located on Paper/Films. A locked storage area was burglarized containing boxes with old invoices containing PHI, including demographic, clinical, SSN, Medicare, and financial data.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 9 weeks / 60 days

Mar 22, 2018

Discovered

May 21, 2018

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,765 affectedView incident

Name: ECHO, Inc.
norm: echo
Domain: echo-inc.org
Industry: Health Care Services

Name: Echo Canyon Healthcare, Incorporated dba Heritage Court Post Acute of Scottsdale
norm: echo canyon healthcare incorporated dba heritage court post acute of scottsdale
Industry: Health Care Services
Also named: Echo Canyon Healthcare, Incorporateddba oflegal entity
Heritage Court Post Acute of Scottsdaledba oftrade name
Industry: Healthcaresource default

Discovered: Mar 22, 2018
Materiality determined: —
Notification sent: —
Affected individuals: 1,765nationwide
Data types: PHIHealth (basic)Identity (basic)Government IDFinancial account
HHS breach type: Theft
Where the data lived: Paper / films
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Provided breach notification to HHSOCR provided substantial technical assistance to the CE and obtained assurances that the CE implemented the corrective actions

During the incident: Provided breach notification to HHS, affected individuals, and the media
Posted notice on its website
Provided a dedicated telephone number and email address for additional information
Offered complimentary credit monitoring for the individuals with financial information potentially disclosed
Provided onsite HIPAA training to all the workforce members on the issues raised in the breach
Changes made: Implemented corrective actions noted by OCR
Provided onsite HIPAA training to all workforce members
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Mar 22, 2018
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Mar 22, 2018
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Mar 22, 2018 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Mar 22, 2018 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: May 21, 2018
Raw hash: 65e15357a5f5b4aedbca71a888c012cd0c6c90bf40ccd4c0292bb4254d21247b

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.0 KB

Download View at source

Reporting entityECHO, Inc.

Victim entityEcho Canyon Healthcare, Incorporated dba Heritage Court Post Acute of Scottsdale

Incidentdiscovered Mar 22, 2018

Stated responseProvided breach notification to HHS, affected individuals, and the media

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing