MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIHighResolved

University of Connecticut Health Center

bd_0baaee7c51a53d83 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 7, 2013

Filed

Mar 7, 2013

To disclose

8 weeks

Affected · nationwide

1,3822 in this filing

Linked

3 filings

Confidence

67%

Full breach record for University of Connecticut Health Center →3 incidents on file

University of Connecticut Health Center notified NH AG of an insider breach on Jan 7, 2013. An employee inappropriately accessed 1,382 patient records (including 2 NH residents). Data included names, DOB, SSN, and PHI. No evidence of misuse found. Notifications sent March 8, 2013, with 2 years credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 59 days

Jan 7, 2013

Discovered

Mar 7, 2013

Filed

vs. sector median

3 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_dc540a11d30e27342013-03-08 · +1dVerified
Massachusetts State AGbd_337d74e3ee3420302013-03-12 · +5dVerified

Name: University of Connecticut Health Center
norm: university of connecticut health center

Name: University of Connecticut Health Center
norm: university of connecticut health center
Industry: Healthcarellm

Discovered: Jan 7, 2013
Materiality determined: —
Notification sent: Mar 8, 2013
Affected individuals: 1,382state + nationwide
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: insider_action

During the incident: Investigated the employee who inappropriately accessed the patient records
Sent notification letters to all patients whose records were inappropriately accessed
Offered all such patients two years of credit monitoring service at no charge through AllClearID
Changes made: Working to prevent any further unauthorized access to patients' medical records
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGMar 7 · first · this page

HHS OCR+1d

Massachusetts State AG+5d

Pattern: first filing Mar 7 (NH), last Mar 12 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/university-connecticut-health-20130307.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 7, 2013
Raw hash: 258ac666158cc4df75a715376fd902ef23ef4672ef27fb6121dcfcd36665b870

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityUniversity of Connecticut Health Center

Victim entityUniversity of Connecticut Health Center

Incidentdiscovered Jan 7, 2013

Stated responseInvestigated the employee who inappropriately accessed the patient records

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov