PUERTO RICOMisuseHealthcareGovernmentFinancial ServicesHealthcareTheftPrivilege AbuseCustomer Data InvolvedData ExfiltratedTargetedHealth (basic)Identity (basic)Government IDMediumResolved

Puerto Rico Department of Heatlh - Medicaid Program

bd_039c8bcade6b9ebe · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 26, 2015

Filed

Apr 22, 2015

To disclose

8 weeks

Affected

500

Confidence

96%

Full breach record for Puerto Rico Department of Heatlh - Medicaid Program →

Puerto Rico Department of Health - Medicaid Program reported to HHS on 2015-04-22 a Theft affecting 500 individuals (4,192 per web description). On 2015-02-26, a Medicaid staff member was arrested for using a personal cell phone to photograph screens of the MEDITI system, selling ePHI of beneficiaries including names, DOBs, SSNs, addresses, phone numbers, gender, and income. The CE conducted risk analyses, updated HIPAA policies, retrained staff, notified affected individuals and media, and provided one year of credit monitoring. OCR obtained corrective action assurances.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 8 weeks / 55 days

Feb 26, 2015

Discovered

Apr 22, 2015

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed500 affectedView incident

Name: Puerto Rico Department of Heatlh - Medicaid Program
norm: puerto rico department of heatlh medicaid program
Industry: Insurance — Health

Name: Puerto Rico Department of Heatlh - Medicaid Program
norm: puerto rico department of heatlh medicaid program
Industry: Insurance — Health
Industry: Healthcaresource defaultGovernmentllmFinancial Servicesllm

Discovered: Feb 26, 2015
Materiality determined: —
Notification sent: —
Affected individuals: 500nationwide
Data types: Health (basic)Identity (basic)Government ID
HHS breach type: Theft
Where the data lived: Other
Covered-entity type: Health plan
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1113 Screen CaptureT1052 Exfiltration Over Physical Medium
Threat actor: InternalFinancial
Regulator citations: HHS OCR breach notification submittedOCR obtained assurances of corrective action implementation
Initial access: insider_action

During the incident: Conducted risk analyses and implemented risk management plans for affiliated entities
Reviewed HIPAA Privacy and Security Rule policies and procedures
Retrained staff in 2017 and 2018
Provided breach notification to HHS, affected individuals, and the media
Provided one year of credit protection to affected individuals
Changes made: Risk analysis and remediation plan expected for Medicaid Department
Risk analysis and remediation plan expected for Emergency Department in Loiza
Risk analysis and remediation plan expected for WIC Department
Risk analysis and remediation plan expected for Intellectual Disability Department
Risk analysis and remediation plan expected for Immunization Department
Risk analysis and remediation plan expected for Demographic Registry Department
Risk analysis and remediation plan expected for Local Centers for Diagnosis and Treatment in Vieques and Adjuntas
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Feb 26, 2015
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Feb 26, 2015
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Feb 26, 2015 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Feb 26, 2015 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 22, 2015
Raw hash: 6dc29034aa84f3bcf06b14be57d45032255ae9b30282b238ac26ce654be7d5dd

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.6 KB

Download View at source

Reporting entityPuerto Rico Department of Heatlh - Medicaid Program

Victim entityPuerto Rico Department of Heatlh - Medicaid Program

Incidentdiscovered Feb 26, 2015

Stated responseConducted risk analyses and implemented risk management plans for affiliated entities

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing