ILLINOISAccidentalHealthcareHealthcareMisconfigurationBusiness Associate (HIPAA)Customer Data InvolvedDelayed DiscoveryPHIHealth (basic)MediumResolved

HealthFitness

bd_3f1a50a16cebe15e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 27, 2018

Filed

Oct 15, 2018

To disclose

16 weeks

Affected

20,790

Confidence

97%

Full breach record for HealthFitness →3 incidents on file

HealthFitness (Health Fitness Corporation), a business associate in IL, reported to HHS OCR on 2018-10-15 an Unauthorized Access/Disclosure affecting 20,790 individuals. Beginning approximately August 2015, ePHI became discoverable on the internet due to a software misconfiguration on the server, exposing it to web crawlers. The breach was discovered on June 27, 2018. OCR settled for $227,816 under its Risk Analysis Initiative.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jun 27, 2018 → Notified Oct 15, 2018110d ✗ HHS report late16 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1061 days

discovery → filing · 16 weeks / 110 days

Aug 1, 2015

Begins

Jun 27, 2018

Discovered

Oct 15, 2018

Filed

vs. sector median

+7 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed20,790 affectedView incident

Name: HealthFitness
norm: healthfitness
Industry: Health Care Services

Name: HealthFitness
norm: healthfitness
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Jun 27, 2018
Breach occurred: Aug 1, 2015
Undetected for: 1,061 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 15, 2018
Affected individuals: 20,790nationwide
Data types: PHIHealth (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Other
Covered-entity type: Business associate
Attack vector: Misconfiguration
Regulator citations: OCR initiated investigation after receiving four breach reports from Health Fitness over a three-month periodSettlement reached with OCR; Health Fitness paid $227,816 to OCRFifth enforcement action in OCR's Risk Analysis InitiativeHealth Fitness agreed to implement a corrective action plan under the resolution agreement

During the incident: Filed four breach reports with OCR on behalf of multiple covered entities as their business associate
Agreed to implement a corrective action plan under the resolution agreement
Paid $227,816 to OCR under the settlement
Changes made: Annually reviewing and updating as necessary its risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI
Developing and implementing a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis
Implementing a process for evaluating environmental and operational changes that affect the security of ePHI
Developing, maintaining, and revising, as necessary, certain written policies and procedures to comply with the HIPAA Privacy, Security, and Breach Notification Rules
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(110 days from discovery to filing)
Compliance flags: HHS report late · 110dHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jun 27, 2018
→ Notified: Oct 15, 2018
110d 60 days HHS report late
HIPAA
Discovered: Jun 27, 2018
→ Notified: Oct 15, 2018
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jun 27, 2018 → Notified: Oct 15, 2018	110d	60 days	HHS report late
HIPAA	Discovered: Jun 27, 2018 → Notified: Oct 15, 2018	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Oct 15, 2018
Raw hash: aec8b8cf7cd6327e6faf7e6a1f0907a11798e22150556f18c641a635071dae6c

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html4.8 KB

Download View at source

Reporting entityHealthFitness

Victim entityHealthFitness

Incidentdiscovered Jun 27, 2018

Stated responseFiled four breach reports with OCR on behalf of multiple covered entities as their business associate

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing