WEST VIRGINIAAccidentalHealthcareHealthcareDisposal ErrorBusiness Associate (HIPAA)Customer Data InvolvedHealth (basic)Identity (basic)Government IDMediumResolved

Amedisys West Virginia, LLC

bd_3b5097a8d4eca90a · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Apr 11, 2017

To disclose

—

Affected

611

Confidence

98%

Full breach record for Amedisys West Virginia, LLC →

Amedisys West Virginia, LLC reported to HHS on 2017-04-11 an Improper Disposal breach affecting 611 individuals. The BA Iron Mountain, through its subcontractor D&M, improperly disposed of two unlocked shred bins containing PHI (paper/films). PHI exposed included names, addresses, dates of birth, SSNs, and clinical information. The CE notified HHS, affected individuals, and the media. Corrective actions included elimination of subcontractor use and improved shred bin security. OCR reviewed risk analysis and BA agreements.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Apr 11, 2017

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed611 affectedView incident

Name: Amedisys West Virginia, LLC
norm: amedisys west virginia
Industry: Health Care Services

Name: Amedisys West Virginia, LLC
norm: amedisys west virginia
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 611nationwide
Data types: Health (basic)Identity (basic)Government ID
HHS breach type: Improper disposal
Where the data lived: Paper / films
Covered-entity type: Healthcare providerBusiness associate involved
Attack vector: Misconfiguration
Threat actor: Partner
Regulator citations: HHS OCR reviewed CE's risk analysis and BA agreements for compliance with Privacy and Security RulesOCR obtained assurances that corrective actions were implemented
Third party: via Iron Mountain (subcontractor: D&M)

During the incident: Breach notification provided to HHS, affected individuals, and media
BA agreed to provide services directly to CE without use of a subcontractor
BA agreed to ensure proper security measures when disposing of shred bins
Changes made: BA eliminated use of subcontractor for shredding services
Corrective security measures implemented for shred bin disposal
OCR reviewed risk analysis and BA agreements for HIPAA compliance
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 11, 2017
Raw hash: bdaae77ac488c9b48182f59fbc2ec39b77776daa0c55039096b43fd25d3425e9

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.8 KB

Download View at source

Reporting entityAmedisys West Virginia, LLC

Victim entityAmedisys West Virginia, LLC

IncidentMisconfiguration

Stated responseBreach notification provided to HHS, affected individuals, and media

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing