CONNECTICUTHackingHealthcareHealthcareData EncryptedCustomer Data InvolvedPHIHealth (basic)Identity (basic)Financial accountMediumContained

Dr. DeLuca Dr. Marciano & Associates, P.C.

bd_0c9156268136298b · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 29, 2018

Filed

Jan 25, 2019

To disclose

8 weeks

Affected

23,578

Linked

4 filings

Confidence

67%

Full breach record for Dr. DeLuca Dr. Marciano & Associates, P.C. →

Dr. DeLuca Dr. Marciano & Associates, P.C. reported to HHS on 2019-01-25 a Hacking/IT Incident affecting 23578 individuals. Breached information located on Desktop Computer, Electronic Medical Record, Network Server. The incident involved a cyber-attack where one server was encrypted (ransomware) and another contained patient names and medical imaging.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time8 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 8 weeks / 57 days

Nov 29, 2018

Begins

Nov 29, 2018

Discovered

Jan 25, 2019

Filed

vs. sector median

4 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_257e599ff2cd23432019-01-25Verified
Massachusetts State AGbd_51102c73d17b6f562019-01-25Verified
New Hampshire State AGbd_3f15bce6ba3695a32019-01-31 · +6dVerified

Name: Dr. DeLuca Dr. Marciano & Associates, P.C.
norm: dr deluca dr marciano associates
Industry: Health Care Services

Name: Dr. DeLuca Dr. Marciano & Associates, P.C.
norm: dr deluca dr marciano associates
Industry: Healthcaresource default

Discovered: Nov 29, 2018
Breach occurred: Nov 29, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 23,578nationwide
Data types: PHIHealth (basic)Identity (basic)Financial account
HHS breach type: Hacking / IT incident
Where the data lived: Desktop computerElectronic medical recordNetwork server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: OCR provided technical assistance to the CE regarding conducting a thorough enterprise-wide risk analysisOCR provided guidance on the development and implementation of written policies and procedures as required by the HIPAA Rules
Initial access: exploit_public_facing

During the incident: Conducted a risk analysis and implemented a risk management plan
Upgraded its firewall and antivirus software
Appointed a new Privacy Officer
Provided additional HIPAA training to all of its workforce members
Provided breach notification to the affected individuals and to the media
Changes made: Conducting a risk analysis and implementing a risk management plan
Upgrading its firewall and antivirus software
Appointing a new Privacy Officer
Providing additional HIPAA training to all of its workforce members
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Nov 29, 2018
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Nov 29, 2018
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Nov 29, 2018 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Nov 29, 2018 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGJan 25 · first

Massachusetts State AGJan 25 · first

HHS OCRJan 25 · first · this page

New Hampshire State AG+6d

Pattern: first filing Jan 25 (MT), last Jan 31 (NH) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jan 25, 2019
Raw hash: 69a63b11804fe50c7daff604974e8cd6cf93e56a8bd24239644bd412ebc14ce3

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.2 KB

Download View at source

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityDr. DeLuca Dr. Marciano & Associates, P.C.

Victim entityDr. DeLuca Dr. Marciano & Associates, P.C.

Incidentdiscovered Nov 29, 2018

Stated responseConducted a risk analysis and implemented a risk management plan

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing