ARKANSASPhysicalHealthcareHealthcareTheftBusiness Associate (HIPAA)Customer Data InvolvedPHIHealth (basic)Identity (basic)Financial accountLowResolved

Arkansas Blue Cross and Blue Shield

bd_2e6ae10cb226ae50 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 16, 2015

Filed

Jul 14, 2015

To disclose

28 days

Affected

560

Confidence

66%

Full breach record for Arkansas Blue Cross and Blue Shield →2 incidents on file

Arkansas Blue Cross and Blue Shield reported to HHS on 2015-07-14 a Theft affecting 560 individuals. Breached information located on Desktop Computer. Two unencrypted desktop computers containing PHI were stolen from business associate Treat Insurance Agency.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jun 16, 2015 → Notified Jul 14, 201528d ✓ HHS report on time28 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 28 days

Jun 16, 2015

Begins

Jun 16, 2015

Discovered

Jul 14, 2015

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed560 affectedView incident

Name: Arkansas Blue Cross and Blue Shield
norm: arkansas blue cross and blue shield
Industry: Insurance — Health

Name: Arkansas Blue Cross and Blue Shield
norm: arkansas blue cross and blue shield
Industry: Healthcaresource default

Discovered: Jun 16, 2015
Breach occurred: Jun 16, 2015
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 14, 2015
Affected individuals: 560nationwide
Data types: PHIHealth (basic)Identity (basic)Financial account
HHS breach type: Theft
Where the data lived: Desktop computer
Covered-entity type: Health planBusiness associate involved
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified HHSOCR reviewed the BA agreement
Third party: via Treat Insurance Agencybusiness associate

During the incident: Provided breach notification to HHS
Provided breach notification to affected individuals
Provided breach notification to the media
Changes made: OCR reviewed the BA agreement and determined it was compliant with 45 C.F.R. §§ 164.314 and 164.504
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: HHS report on time · 28dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jun 16, 2015
→ Notified: Jul 14, 2015
28d 60 days HHS report on time
HIPAA
Discovered: Jun 16, 2015
→ Notified: Jul 14, 2015
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jun 16, 2015 → Notified: Jul 14, 2015	28d	60 days	HHS report on time
HIPAA	Discovered: Jun 16, 2015 → Notified: Jul 14, 2015	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jul 14, 2015
Raw hash: 73429b18bdd6ffab089b668f40141d5c4a2f2c3d325a860772f83f5fce53ef40

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.7 KB

Download View at source

Reporting entityArkansas Blue Cross and Blue Shield

Victim entityArkansas Blue Cross and Blue Shield

Incidentdiscovered Jun 16, 2015

Stated responseProvided breach notification to HHS

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing