NEW YORKPhysicalHealthcareHealthcareTheftCustomer Data InvolvedPHIHealth (basic)HighResolved

The Feinstein Institute for Medical Reserch

bd_5087b0c785d37d67 · schema v1 · pii pii-v1

Severity

High

Financial impact

$3.90M

Discovered

—

Filed

Sep 14, 2012

To disclose

—

Affected

13,000

Confidence

69%

Full breach record for The Feinstein Institute for Medical Reserch →

The Feinstein Institute for Medical Research reported to HHS on 2012-09-14 a Theft affecting 13000 individuals. Breached information located on Laptop. The institute settled potential HIPAA violations, paying $3.9 million and implementing a corrective action plan including risk analysis, policies, and workforce training.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Sep 14, 2012

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed13,000 affectedView incident

Name: The Feinstein Institute for Medical Reserch
norm: the feinstein institute for medical reserch
Industry: Health Care Services

Name: The Feinstein Institute for Medical Reserch
norm: the feinstein institute for medical reserch
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: Sep 14, 2012
Affected individuals: 13,000nationwide
Data types: PHIHealth (basic)
HHS breach type: Theft
Where the data lived: Laptop
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: Internal
Regulator citations: Notified OCR of breach involving unsecured electronic protected health information (ePHI)OCR initiated an investigation to ascertain the entity’s compliance with HIPAA Rules

During the incident: Agreed to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules
Paid $3.9 million
Adopted a robust corrective action plan to correct deficiencies in its HIPAA compliance program
Changes made: Established a comprehensive compliance program designed to protect the security, confidentiality, and integrity of ePHI
Conducted a risk analysis and a risk management plan
Implemented a process to evaluate and address any environmental or operational changes that affect the security of the ePHI
Implemented policies and procedures to facilitate compliance with requirements of the HIPAA Rules
Implemented a training program covering the requirements of the Privacy, Security, and Breach Notification Rules
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: Sep 14, 2012
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: Sep 14, 2012	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Sep 14, 2012
Raw hash: 9e5086b4264f70ecd854f8bc4ac46272cb9d0bac607af9e762c415804b1e62d4

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html4.1 KB

Download View at source

Reporting entityThe Feinstein Institute for Medical Reserch

Victim entityThe Feinstein Institute for Medical Reserch

IncidentUnauthorized Access

Stated responseAgreed to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing