TEXASPhysicalHealthcareGovernmentHealthcareLossBusiness Associate (HIPAA)Customer Data InvolvedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTMediumResolved

Texas Health and Human Services Commission

bd_600d39d4670456aa · schema v1 · pii pii-v1

Full breach record for Texas Health and Human Services Commission →

Texas Health and Human Services Commission (TX Health Plan) reported to HHS on 2016-06-14 a Loss of Paper/Films affecting 600 individuals. Between April 19 and May 10, 2016, Iron Mountain, a business associate, was unable to locate sixteen cartons of records containing PHI, including names, addresses, SSNs, dates of birth, medical record numbers, Medicaid/individual numbers, case numbers, and bank account numbers. CE notified HHS, affected individuals, and media; BA retrained staff; CE revised file inventory reconciliation and box destruction procedures. OCR obtained assurances of corrective action.

HIPAA clock✓ HHS notified5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed600 affectedView incident

Source provenance

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jun 14, 2016
Raw hash: ce2dc93b25c338efbe8e8fb054ece9c210d24b394c4f06eff1090867b07ecf11

Source filing

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.9 KB

Download View at source

Reporting entity

Name: Texas Health and Human Services Commission
norm: texas health and human services commission
Industry: Insurance — Health

Victim entity

Name: Texas Health and Human Services Commission
norm: texas health and human services commission
Industry: Insurance — Health
Industry: Healthcaresource defaultGovernmentllm

Incident

Discovered: May 10, 2016
Materiality determined: —
Notification sent: —
Affected individuals: 600
Data types: IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNT
Attack vector: Unauthorized Access· Iron Mountain
Threat actor: Partner
Regulator citations: HHS OCR — breach notification submitted; OCR obtained assurances of corrective action implementation
Third party: via Iron Mountain

Compliance

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: May 10, 2016
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: May 10, 2016 → Notified: not extracted	—	regulatory submission	HHS notified

Extraction provenance

Status: No extraction artifact recorded for this disclosure.