MNAccidentalHealthcareHealthcareMisconfigurationBusiness Associate (HIPAA)Customer Data InvolvedHEALTH_BASICIDENTITY_BASICMETADATAMediumResolved

StayWell Health Management, LLC

bd_1ab39edd45af25a2 · schema v1 · pii pii-v1

Full breach record for StayWell Health Management, LLC →

StayWell Health Management, LLC, a business associate of Missouri Consolidated Health Care Plan, reported to HHS on 2014-02-21 an Unauthorized Access/Disclosure affecting 10,024 individuals. On that date, the BA erroneously made a spreadsheet accessible via an internet link. The spreadsheet contained participants' names, email addresses, internal IDs, wellness program status, email notification info, and survey completion data. Breached information was located on a Network Server. The BA removed the spreadsheet, implemented a legacy system for ePHI in transit, and the CE updated its Privacy and Security Policy with encryption standards. OCR obtained documented assurances of corrective actions.

HIPAA clock✓ HHS notified≤1 day discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed10,024 affectedView incident

Source provenance

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 21, 2014
Raw hash: 4248178b11d3b273cc2f2c52a7a49dfdab48b286c4d52e67c9d778a2f8899961

Source filing

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.1 KB

Download View at source

Reporting entity

Name: StayWell Health Management, LLC
norm: staywell health management

Victim entity

Name: StayWell Health Management, LLC
norm: staywell health management
Industry: Healthcaresource default

Incident

Discovered: Feb 21, 2014
Materiality determined: —
Notification sent: —
Affected individuals: 10,024
Data types: HEALTH_BASICIDENTITY_BASICMETADATA
Attack vector: Unauthorized Access
Threat actor: Partner
Regulator citations: HHS OCR obtained documented assurances that corrective actions were implemented by both the CE and BA
Third party: via StayWell Health Management, LLCbusiness associate

Compliance

Time to disclose: ≤1 day(0 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Feb 21, 2014
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Feb 21, 2014 → Notified: not extracted	—	regulatory submission	HHS notified

Extraction provenance

Status: No extraction artifact recorded for this disclosure.