NEW YORKPhysicalHealthcareHealthcareLossBusiness Associate (HIPAA)Customer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumResolved

Amsterdam Nursing Home Corporation (1992)

bd_074ebe59d0454992 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jul 10, 2015

To disclose

—

Affected

621

Confidence

97%

Full breach record for Amsterdam Nursing Home Corporation (1992) →

Amsterdam Nursing Home Corporation (1992) reported to HHS on 2015-07-10 a Loss affecting 621 individuals. PHI stored by business associate Citistorage, LLC was impermissibly disclosed on January 31, 2015 during efforts to extinguish a fire at the BA's facility. Breached information located on Paper/Films. PHI involved included residents' names, addresses, dates of birth, health insurance information, social security numbers, and health status/treatment details. OCR opened an investigation leading to multiple remediation steps.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline

Jan 31, 2015

Begins

Jul 10, 2015

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed621 affectedView incident

Name: Amsterdam Nursing Home Corporation (1992)
norm: amsterdam nursing home corporation 1992
Industry: Health Care Services

Name: Amsterdam Nursing Home Corporation (1992)
norm: amsterdam nursing home corporation 1992
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Breach occurred: Jan 31, 2015
Materiality determined: —
Notification sent: —
Affected individuals: 621nationwide
Data types: Identity (basic)Government IDHealth (basic)Financial account
HHS breach type: Loss
Where the data lived: Paper / films
Covered-entity type: Healthcare providerBusiness associate involved
Attack vector: Unauthorized Access
Threat actor: Partner
Regulator citations: OCR investigation opened; investigation resulted in remediation requirements
Third party: via Citistorage, LLCbusiness associate

During the incident: CE recorded the impermissible disclosure for accounting of disclosure purposes
CE reminded BA of its notification obligations per the BA agreement
CE obtained written assurances from BA of compliance with building and safety codes
CE re-issued HIPAA-compliant breach notification letters to affected individuals in Massachusetts
Changes made: Breach notifications sent to HHS, affected individuals, and media
Substitute notification posted on website
Accounting of disclosures updated
BA compliance assurances obtained
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jul 10, 2015
Raw hash: 27b89e9157958f17460249bbed16e6c7a2f06b6ec3692b5f5b350715bf70b190

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.1 KB

Download View at source

Reporting entityAmsterdam Nursing Home Corporation (1992)

Victim entityAmsterdam Nursing Home Corporation (1992)

IncidentUnauthorized Access

Stated responseCE recorded the impermissible disclosure for accounting of disclosure purposes

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing