FLORIDAMisuseHealthcareHealthcarePrivilege AbuseKnowledge AbuseCustomer Data InvolvedBusiness Associate (HIPAA)Health (basic)Identity (basic)MediumResolved

Aventura Hospital and Medical Center

bd_25470069f8020894 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 28, 2014

Filed

Sep 11, 2014

To disclose

15 weeks

Affected

82,601

Linked

3 filings

Confidence

95%

Full breach record for Aventura Hospital and Medical Center →3 incidents on file

Aventura Hospital and Medical Center (FL) reported to HHS on 2014-09-11 a Theft/Unauthorized Access breach affecting 82,601 individuals. On or around May 28, 2014, an employee of Valesco Ventures — a contractor providing staffing and ancillary services — inappropriately accessed the PHI of approximately 82,601 patients, including demographic information, via the hospital's network server. The CE notified HHS, affected individuals, and the media, offered credit monitoring and identity theft protection, retrained staff, updated audit controls, tightened system access approvals, revised BA contracts, and completed a new risk analysis and risk management plan. OCR obtained assurances that all corrective actions were implemented.

J jump to incidentP pin to compareR raw source

HIPAA clock✗ HHS report late15 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 15 weeks / 106 days

May 28, 2014

Begins

May 28, 2014

Discovered

Sep 11, 2014

Filed

vs. sector median

+3 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_718f4a6f318a44b62014-09-08 · +3dVerified
HHS OCRbd_0812d5dd30a7dcb72014-08-26 · +16dCandidate

Name: Aventura Hospital and Medical Center
norm: aventura hospital and medical center
Industry: Health Care Services

Name: Aventura Hospital and Medical Center
norm: aventura hospital and medical center
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: May 28, 2014
Breach occurred: May 28, 2014
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 82,601nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: TheftUnauthorized access or disclosure
Where the data lived: Network server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access· Valesco Ventures employee
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Partner
Regulator citations: HHS OCR breach notification submittedOCR obtained assurances that corrective actions were implemented
Third party: via Valesco Venturescontractor staffing and ancillary services
Initial access: valid_credentials

During the incident: Breach notification provided to HHS, affected individuals, and media
Substitute notice posted on website
Credit monitoring and identity theft protection offered to affected individuals
Workforce re-trained on HIPAA Privacy and Security policies and procedures
Audit functions updated to capture similar unauthorized activities
Reviewed all user access and made changes as needed
Increased approval level required for system access
Business associate contracts revised with business partners
New risk analysis performed and updated risk management plan created
Changes made: Enhanced audit functions
Increased access approval requirements
Revised business associate contracts
Updated risk management plan and risk analysis
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(106 days from discovery to filing)
Compliance flags: HHS report lateHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: May 28, 2014
→ Notified: not extracted
— 60 days HHS report late
HIPAA
Discovered: May 28, 2014
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: May 28, 2014 → Notified: not extracted	—	60 days	HHS report late
HIPAA	Discovered: May 28, 2014 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

HHS OCRAug 26 · first

Massachusetts State AG+13d

HHS OCR+16d · this page

Pattern: first filing Aug 26 (FL), last Sep 11 (FL) — a 16-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Sep 11, 2014
Raw hash: 53f4818878cfeb1e48ff12db308a4e383182aae351965e9e34d974ee11867516

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.2 KB

Download View at source

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAventura Hospital and Medical Center

Victim entityAventura Hospital and Medical Center

Incidentdiscovered May 28, 2014

Stated responseBreach notification provided to HHS, affected individuals, and media

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing