COLORADOMalwareHealthcareHealthcareRansomwareCustomer Data InvolvedData EncryptedHealth (basic)Identity (basic)Financial accountMediumResolved

Allergy, Asthma & Immunology of the Rockies, PC

bd_15f1e0d73ac4af5a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 17, 2016

Filed

Jun 17, 2016

To disclose

—

Affected

6,851

Confidence

97%

Full breach record for Allergy, Asthma & Immunology of the Rockies, PC →

On June 17, 2016, Allergy, Asthma & Immunology of the Rockies, PC (Colorado) discovered its network server had been hacked with evidence of ransomware and unknown accounts on the system. ePHI of up to 6,851 individuals—including demographic, financial, and clinical information—was compromised. The CE replaced the infected hard drive, rebuilt its system, and implemented a VPN. OCR's investigation led to revised ePHI safeguarding procedures, updated risk analysis, and risk management plan improvements.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jun 17, 2016 → Notified Jun 17, 20160d ✓ HHS report on time

⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Incident timeline

discovery → filing · ≤1 day / 0 days

Jun 17, 2016

Discovered

Jun 17, 2016

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed6,851 affectedView incident

Name: Allergy, Asthma & Immunology of the Rockies, PC
norm: allergy asthma immunology of the rockies
Industry: Health Care Services

Name: Allergy, Asthma & Immunology of the Rockies, PC
norm: allergy asthma immunology of the rockies
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Jun 17, 2016
Materiality determined: —
Notification sent: Jun 17, 2016
Affected individuals: 6,851nationwide
Data types: Health (basic)Identity (basic)Financial account
HHS breach type: Hacking / IT incident
Where the data lived: Network server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1078 Valid Accounts
Threat actor: ExternalFinancial
Regulator citations: HHS OCR investigation; CE revised procedures for safeguarding ePHI and protecting against malicious software; CE updated risk analysis and risk management plan per OCR technical assistance on HIPAA Security Rule.

During the incident: Replaced infected computer hard drive
Rebuilt IT system
Implemented a virtual private network (VPN) to protect against future incidents
Provided breach notification to HHS, affected individuals, and the media
Changes made: Revised procedures for safeguarding ePHI and protecting against malicious software
Updated risk analysis and risk management plan per OCR Security Rule guidance
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS report on time · 0dHHS notified
Discovery-date grounding: notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jun 17, 2016
→ Notified: Jun 17, 2016
0d 60 days HHS report on time
HIPAA
Discovered: Jun 17, 2016
→ Notified: Jun 17, 2016
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jun 17, 2016 → Notified: Jun 17, 2016	0d	60 days	HHS report on time
HIPAA	Discovered: Jun 17, 2016 → Notified: Jun 17, 2016	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jun 17, 2016
Raw hash: f5701c95b49618f7069d0bb65916ffcf6231bce88c14ffcfba659a3d24f9ae7f

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.0 KB

Download View at source

Reporting entityAllergy, Asthma & Immunology of the Rockies, PC

Victim entityAllergy, Asthma & Immunology of the Rockies, PC

Incidentdiscovered Jun 17, 2016

Stated responseReplaced infected computer hard drive

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing