DisclosureLens
FEDERALUnknownLow

Northeast Radiology

bd_0f3fa12d8c2e6fa0 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Apr 4, 2025

To disclose

—

Affected

Not disclosed

Linked

4 filings

Confidence

90%
Full breach record for Northeast Radiology →

Regulator's decision — not a breach notification

This record is a regulator's decision, not the organisation's own breach notice. Breach-notification fields (discovery date, notification clock) are structurally absent — what this source establishes is the outcome and the provisions the decision cites.

HHS OCR settled a HIPAA Security Rule investigation with Northeast Radiology, P.C. (NERAD) for $350,000. The settlement resolved allegations that NERAD failed to conduct an accurate and thorough risk analysis of vulnerabilities to ePHI stored in its PACS server, where unauthorized individuals accessed radiology images. NERAD agreed to a Corrective Action Plan including risk analysis, risk management, policy updates, and workforce training.

Incident timeline — partial

? — ?

Breach window unknown

Apr 4, 2025

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a breach filing is linked. This record is the regulator's action, not a breach notice. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Filing propagation · 4 filings · 3 states

View merged incident ↗
Montana State AGMar 11 · first
HHS OCRMar 11 · first
Massachusetts State AGMar 11 · first
HHS OCR enforcement+1850d · this page

Pattern: first filing Mar 11 (MT), last Apr 4 — a 1850-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source ceiling

  • instrument + outcome
  • amount as filed (USD)
  • CFR provisions
  • the breach it recites
  • discovery date
  • notification clock

The dates the agreement recites belong to the underlying breach, years earlier, and are kept as evidence of WHICH breach rather than as this record’s timeline.