Puerto Rico Department of Heatlh - Medicaid Program
bd_039c8bcade6b9ebe · schema v1 · pii pii-v1
Full breach record for Puerto Rico Department of Heatlh - Medicaid Program →Puerto Rico Department of Health - Medicaid Program reported to HHS on 2015-04-22 a Theft affecting 500 individuals (4,192 per web description). On 2015-02-26, a Medicaid staff member was arrested for using a personal cell phone to photograph screens of the MEDITI system, selling ePHI of beneficiaries including names, DOBs, SSNs, addresses, phone numbers, gender, and income. The CE conducted risk analyses, updated HIPAA policies, retrained staff, notified affected individuals and media, and provided one year of credit monitoring. OCR obtained corrective action assurances.
Source provenance
- Source URL
- https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
- Filed at
- Apr 22, 2015
- Raw hash
- 6dc29034aa84f3bcf06b14be57d45032255ae9b30282b238ac26ce654be7d5dd
Source filing
Reporting entity
- Name
- Puerto Rico Department of Heatlh - Medicaid Programnorm: puerto rico department of heatlh medicaid program
- Industry
- Insurance — Health
Victim entity
- Name
- Puerto Rico Department of Heatlh - Medicaid Programnorm: puerto rico department of heatlh medicaid program
- Industry
- Insurance — Health
- Industry
- Healthcaresource defaultGovernmentllmFinancial Servicesllm
Incident
- Discovered
- Feb 26, 2015
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- 500
- Data types
- HEALTH_BASICIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1113 Screen CaptureT1052 Exfiltration Over Physical Medium
- Threat actor
- InternalFinancial
- Regulator citations
- HHS OCR breach notification submittedOCR obtained assurances of corrective action implementation
- Initial access
- insider_action
Compliance
- Time to disclose
- 8 weeks(55 days from discovery to filing)
- Compliance flags
- HHS notified
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status HIPAA Discovered: Feb 26, 2015→ Notified: not extracted— regulatory submission HHS notified
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.