LOUISIANAMisuseHealthcareHealthcarePrivilege AbuseLossCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)HighResolved

AMEDISYS, INC.

bd_131827e29580fc23 · schema v1 · pii pii-v1

Severity

High

Discovered

Feb 23, 2015

Filed

Mar 1, 2015

To disclose

6 days

Affected

6,909

Linked

3 filings

Confidence

95%

Full breach record for AMEDISYS, INC. →3 incidents on file

On February 23, 2015, Amedisys, Inc. (LA) discovered that 142 encrypted computers and laptops were unaccounted for, accessible to former employees who had left or been terminated between January 1, 2011 and December 31, 2014. The devices contained ePHI of approximately 6,909 individuals, including names, dates of birth, addresses, SSNs, diagnoses, lab results, medications, treatment info, and claims. Breach notification was sent to HHS, individuals, and media. Remediation included enhanced termination/device recovery policies and an offline device freeze capability. Breached information located on Desktop Computer, Electronic Medical Record, and Laptop.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Feb 23, 2015 → Notified Mar 1, 20156d ✓ HHS report on time6 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1514 days

discovery → filing · 6 days

Jan 1, 2011

Begins

Feb 23, 2015

Discovered

Mar 1, 2015

Filed

vs. sector median

8 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_8c4828bb74c5b3682015-03-02 · +1dCandidate
Massachusetts State AGbd_27012ff06c335e942015-03-04 · +3dVerified

Name: AMEDISYS, INC.
norm: amedisys
Domain: amedisys.com
Industry: Health Care Services

Name: AMEDISYS, INC.
norm: amedisys
Domain: amedisys.com
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Feb 23, 2015
Breach occurred: Jan 1, 2011 – Dec 31, 2014
Undetected for: 1,514 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 1, 2015
Affected individuals: 6,909nationwide
Data types: Identity (basic)Government IDHealth (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Desktop computerElectronic medical recordLaptop
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical MediumT1078 Valid Accounts
Threat actor: Internal
Regulator citations: HHS OCR provided technical assistance regarding conducting a risk analysis and requirements to identify and assess potential risks and vulnerabilities of ePHI.CE hired a third-party vendor to conduct a complete enterprise-wide risk analysis to be provided to OCR upon completion.
Initial access: insider_action

During the incident: Provided breach notification to HHS, individuals, and the media.
Implemented an enhanced termination policy and device recovery process.
Implemented software providing an offline device freeze policy for devices not connecting to the network for a period of time.
Changes made: Enhanced termination policy and device recovery process implemented.
Offline device freeze software deployed to lock out unconnected devices.
Enterprise-wide risk analysis commissioned via third-party vendor.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 days(6 days from discovery to filing)
Compliance flags: HHS report on time · 6dHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Feb 23, 2015
→ Notified: Mar 1, 2015
6d 60 days HHS report on time
HIPAA
Discovered: Feb 23, 2015
→ Notified: Mar 1, 2015
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Feb 23, 2015 → Notified: Mar 1, 2015	6d	60 days	HHS report on time
HIPAA	Discovered: Feb 23, 2015 → Notified: Mar 1, 2015	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRMar 1 · first · this page

New Hampshire State AG+1d

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Mar 1, 2015
Raw hash: c401d1cf9d70f10bcfbfcbaa4c6e6972326342f203b246c2c043943c99452f38

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.2 KB

Download View at source

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAMEDISYS, INC.

Victim entityAMEDISYS, INC.

Incidentdiscovered Feb 23, 2015

Stated responseProvided breach notification to HHS, individuals, and the media.

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing