MisuseHealthcareHealthcarePrivilege AbuseData ExfiltratedCustomer Data InvolvedEmployee Data InvolvedDelayed DiscoveryPHIHealth (basic)Identity (basic)LowActive

Berkshire Health Systems, Inc.

bd_04f955ac68e6b66d · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 3, 2025

Filed

Aug 4, 2025

To disclose

9 weeks

Affected · nationwide

5001 in this filing

Linked

2 filings

Confidence

66%

Full breach record for Berkshire Health Systems, Inc. →3 incidents on file

Berkshire Health Systems, Inc. (BHS) notified the NH Attorney General and HHS of an insider threat involving a rogue employee at Fairview Hospital. The employee, hired in 2014, allegedly accessed patient records in the EMR system without legitimate business purpose starting potentially as early as 2014. The incident involves PHI (names, DOB, diagnosis, visit notes) of approximately 500 individuals. The employee was terminated, and BHS is conducting a lookback from Oct 2022. No evidence of data exfiltration was found, but access was unauthorized. BHS has implemented enhanced auditing and staff re-education.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4171 days

discovery → filing · 9 weeks / 62 days

Jan 1, 2014

Begins

Jun 3, 2025

Discovered

Aug 4, 2025

Filed

vs. sector median

3 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_e39a1950d683185a2025-07-30 · +5dCandidate

Name: Berkshire Health Systems, Inc.
norm: berkshire health
Domain: bhs1.org

Name: Berkshire Health Systems, Inc.
norm: berkshire health
Domain: bhs1.org
Industry: Healthcarellm

Discovered: Jun 3, 2025
Breach occurred: Jan 1, 2014
Undetected for: 4,171 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 30, 2025
Affected individuals: 500state + nationwide
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Insider
MITRE ATT&CK: T1530 Data from Cloud Storage Object
Threat actor: Internal
Regulator citations: Notified U.S. Department of Health and Human Services (HHS)Filed notice with New Hampshire Office of the Attorney General
Initial access: insider_action

During the incident: Terminated the rogue employee
Discontinued access to the electronic medical record
Launched an internal investigation
Implemented mandatory re-education of all staff on HIPAA privacy and security requirements
Began a comprehensive review and update of internal policies and procedures related to HIPAA compliance and access controls
Deployed enhanced auditing and monitoring software to detect and flag unauthorized access to PHI
Optimization of privacy monitoring software
Changes made: Mandatory re-education of all staff on HIPAA privacy and security requirements, with an emphasis on appropriate access to PHI
Comprehensive review and update of internal policies and procedures related to HIPAA compliance and access controls
Deployed enhanced auditing and monitoring software to detect and flag unauthorized access to PHI
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(62 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCRJul 30 · first

New Hampshire State AG+5d · this page

Pattern: first filing Jul 30 (MA), last Aug 4 (NH) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/berkshire-health-systems-20250804.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 4, 2025
Raw hash: ce4643a16d517d024fac398b828568b6a89b14c54247c7605df74da43412da12

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBerkshire Health Systems, Inc.

Victim entityBerkshire Health Systems, Inc.

Incidentdiscovered Jun 3, 2025

Stated responseTerminated the rogue employee

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov