OKAccidentalHealthcareFinancial ServicesHealthcareMisconfigurationBusiness Associate (HIPAA)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASICHighResolved

Oklahoma Healthcare Authority (OHCA)

bd_4ded2ad0030e3fd0 · schema v1 · pii pii-v1

Full breach record for Oklahoma Healthcare Authority (OHCA) →

Oklahoma Health Care Authority (OHCA), a Health Plan in Oklahoma, reported to HHS on 2022-02-03 an Unauthorized Access/Disclosure affecting 8,629 individuals. The covered entity's business associate discovered a configuration issue within a patient portal that compromised PHI. Information exposed included names, dates of birth, addresses, Social Security numbers, and account information, located on a Network Server. OHCA notified HHS, affected individuals, and the media, and implemented additional technical safeguards. OCR provided technical assistance on business associate agreement requirements.

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed8,629 affectedView incident

Source provenance

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 3, 2022
Raw hash: f9fc3f30dc2a0098773ce6217301b4c7d4039b038dd3fee416fe8280a4e04841

Source filing

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.6 KB

Download View at source

Reporting entity

Name: Oklahoma Healthcare Authority (OHCA)
norm: oklahoma healthcare authority ohca
Industry: Insurance — Health

Victim entity

Name: Oklahoma Healthcare Authority (OHCA)
norm: oklahoma healthcare authority ohca
Industry: Insurance — Health
Industry: Healthcaresource defaultFinancial Servicesllm

Incident

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 8,629
Data types: IDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNTHEALTH_BASIC
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: Partner
Regulator citations: OCR provided the CE with technical assistance regarding the requirements of business associate agreements.
Initial access: trusted_relationship

Compliance

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Extraction provenance

Status: No extraction artifact recorded for this disclosure.