NEW JERSEYMisuseHealthcareHealthcarePrivilege AbuseTheftCustomer Data InvolvedData ExfiltratedEmployee Data InvolvedHealth (basic)Identity (basic)Government IDFinancial accountHighResolved

Options Counseling Center

bd_402cfd82d3b36bac · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

May 9, 2014

To disclose

—

Affected

2,828

Confidence

97%

Full breach record for Options Counseling Center →

Options Counseling Center (NJ) reported to HHS OCR on 2014-05-09 a Theft/Unauthorized Access breach affecting 2,828 individuals. Between May 1 and July 29, 2011, an employee (insider) photocopied and printed PHI from the computer system and disclosed documents to their attorney. PHI included names, counseling attendance records, addresses, DOBs, health insurance info, account balances, and 46 SSNs. Breached information was on Paper/Films. CE destroyed disclosed PHI, retrained staff, restricted physical access, and migrated to an electronic billing system with role-based access. OCR confirmed corrective actions.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline

May 1, 2011

Begins

May 9, 2014

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,828 affectedView incident

Name: Options Counseling Center
norm: options counseling center
Industry: Health Care Services

Name: Options Counseling Center
norm: options counseling center
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Breach occurred: May 1, 2011 – Jul 29, 2011
Materiality determined: —
Notification sent: —
Affected individuals: 2,828nationwide
Data types: Health (basic)Identity (basic)Government IDFinancial account
HHS breach type: TheftUnauthorized access or disclosure
Where the data lived: Paper / films
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical MediumT1078 Valid Accounts
Threat actor: Internal
Regulator citations: HHS OCR investigation opened; OCR obtained assurances that corrective actions were implemented.
Initial access: insider_action

During the incident: Ensured destruction of PHI possessed by the former employee and/or his attorney
Retrained staff
Restricted number of personnel holding keys to rooms and file cabinets containing PHI
Converted paper billing system to electronic billing system with password-protected role-based access
Changes made: Implemented new physical access safeguards (key restrictions for PHI-containing rooms and cabinets)
Implemented electronic billing system with role-based access controls
Staff retraining on PHI handling
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: May 9, 2014
Raw hash: 431f2d3def74caa238f41153ca5fe83a7ffb11536ce10620d15d3146d7dd5600

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.2 KB

Download View at source

Reporting entityOptions Counseling Center

Victim entityOptions Counseling Center

IncidentUnauthorized Access

Stated responseEnsured destruction of PHI possessed by the former employee and/or his attorney

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing