AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedData ExfiltratedPHIHealth (basic)Government IDIdentity (basic)MediumResolved

Steward Medical Group

bd_5fd4ec2d09548bc2 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 19, 2021

Filed

May 26, 2021

To disclose

10 weeks

Affected

1state residents only

Linked

3 filings

Confidence

67%

Full breach record for Steward Medical Group →9 incidents on file

Steward Medical Group, Inc. notified the NH Attorney General of a data security incident involving one NH resident. On March 19, 2021, SMG discovered that its billing agent, MiraMed Global Services, inadvertently mailed protected health information (PHI) and PII (including SSN, DOB, name) to the wrong workers' compensation carrier (City of Boston). The error occurred during billing data transfer. SMG contacted the carrier, ensured data destruction/return, fixed the system error, and reviewed policies. The resident was notified on May 18, 2021, and offered 24 months of Experian IdentityWorks.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 10 weeks / 68 days

Mar 19, 2021

Discovered

May 26, 2021

Filed

vs. sector median

1 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_443490f938e3ffae2021-05-21 · +5dVerified
HHS OCRbd_5f9a081ac760ec932021-06-04 · +9dVerified

Name: Steward Medical Group
norm: steward medical

Name: Steward Medical Group
norm: steward medical
Industry: Healthcarellm

Discovered: Mar 19, 2021
Materiality determined: —
Notification sent: May 18, 2021
Affected individuals: 1state-resident count only
Data types: PHIHealth (basic)Government IDIdentity (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Misconfiguration
MITRE ATT&CK: T1567 Misdelivery
Regulator citations: Notified New Hampshire Office of the Attorney General
Third party: via MiraMed Global Servicesbusiness associate

During the incident: Contacted the carrier to investigate the cause of the incident
Ensured that no further disclosures were made
Confirmed that the information was either destroyed or returned to Steward
Contacted MiraMed to further investigate how and why the improper disclosure was made
Addressed the system error so that no future disclosures were made
Conducted a thorough review of its policies, including its written information security program
Worked with the City of Boston and MiraMed to resolve incident
Sent a notice by mail to the New Hampshire resident
Offered the resident a twenty-four-month Experian's IdentityWorks membership for credit monitoring services
Changes made: Addressed the system error so that no future disclosures were made
Conducted a thorough review of its policies, including its written information security program
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(68 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 2 states

View merged incident ↗

Massachusetts State AGMay 21 · first

New Hampshire State AG+5d · this page

HHS OCR+14d

Pattern: first filing May 21 (MA), last Jun 4 (MA) — a 14-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/steward-medical-group-20210526.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 26, 2021
Raw hash: b1b4f46898418308cb8d455807ecb6bc12445dadd89553fe96f54c4ee830c26c

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entitySteward Medical Group

Victim entitySteward Medical Group

Incidentdiscovered Mar 19, 2021

Stated responseContacted the carrier to investigate the cause of the incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov