ILLINOISAccidentalHealthcareHealthcareMisconfigurationBusiness Associate (HIPAA)Customer Data InvolvedPHIHealth (basic)MediumResolved

Health Fitness Corporation

bd_31778e6299a2faed · schema v1 · pii pii-v1

Severity

Medium

Financial impact

$228K

Discovered

Jun 27, 2018

Filed

Oct 15, 2018

To disclose

16 weeks

Affected

550

Linked

4 filings

Confidence

66%

Full breach record for Health Fitness Corporation →2 incidents on file

Health Fitness Corporation reported to HHS on 2018-10-15 a Unauthorized Access/Disclosure affecting 550 individuals. Breached information located on Other. The incident involved a software misconfiguration on a server housing ePHI, making it discoverable on the internet starting in August 2015. Health Fitness, a Business Associate, filed reports on behalf of multiple covered entities.

J jump to incidentP pin to compareR raw source

HIPAA clock✗ HHS report late16 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1061 days

discovery → filing · 16 weeks / 110 days

Aug 1, 2015

Begins

Jun 27, 2018

Discovered

Oct 15, 2018

Filed

vs. sector median

+3 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_bc2a378cc8c602d12018-10-05 · +10dVerified
HHS OCRbd_fed8e04c67fd98f92018-10-28 · +13dCandidate
HHS OCR enforcementbd_9da38ad954609d452025-03-21 · +2349dVerified by operator

Name: Health Fitness Corporation
norm: health fitness
Industry: Health Care Services

Name: Health Fitness Corporation
norm: health fitness
Industry: Healthcaresource default

Discovered: Jun 27, 2018
Breach occurred: Aug 1, 2015
Undetected for: 1,061 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 550nationwide
Data types: PHIHealth (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Other
Covered-entity type: Business associate
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Initial access: exploit_public_facing

During the incident: Paid $227,816 to OCR
Agreed to implement a corrective action plan
Changes made: Annually reviewing and updating as necessary its risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI
Developing and implementing a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis
Implementing a process for evaluating environmental and operational changes that affect the security of ePHI
Developing, maintaining, and revising, as necessary, certain written policies and procedures to comply with the HIPAA Privacy, Security, and Breach Notification Rules
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(110 days from discovery to filing)
Compliance flags: HHS report lateHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jun 27, 2018
→ Notified: not extracted
— 60 days HHS report late
HIPAA
Discovered: Jun 27, 2018
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jun 27, 2018 → Notified: not extracted	—	60 days	HHS report late
HIPAA	Discovered: Jun 27, 2018 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 2 states

View merged incident ↗

Massachusetts State AGOct 5 · first

HHS OCR+10d · this page

HHS OCR+23d

HHS OCR enforcement+2359d

Pattern: first filing Oct 5 (MA), last Mar 21 — a 2359-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Oct 15, 2018
Raw hash: 05fe30d5e94fd0658d794a8ee5880df862d92adc564da1bda98b2621c8c640dd

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html4.8 KB

Download View at source

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityHealth Fitness Corporation

Victim entityHealth Fitness Corporation

Incidentdiscovered Jun 27, 2018

Stated responsePaid $227,816 to OCR

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing