TEXASPhysicalHealthcareGovernmentHealthcareLossBusiness Associate (HIPAA)Customer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountMediumResolved

Texas Health and Human Services Commission

bd_600d39d4670456aa · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 10, 2016

Filed

Jun 14, 2016

To disclose

5 weeks

Affected

600

Confidence

98%

Full breach record for Texas Health and Human Services Commission →6 incidents on file

Texas Health and Human Services Commission (TX Health Plan) reported to HHS on 2016-06-14 a Loss of Paper/Films affecting 600 individuals. Between April 19 and May 10, 2016, Iron Mountain, a business associate, was unable to locate sixteen cartons of records containing PHI, including names, addresses, SSNs, dates of birth, medical record numbers, Medicaid/individual numbers, case numbers, and bank account numbers. CE notified HHS, affected individuals, and media; BA retrained staff; CE revised file inventory reconciliation and box destruction procedures. OCR obtained assurances of corrective action.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time5 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 21 days

discovery → filing · 5 weeks / 35 days

Apr 19, 2016

Begins

May 10, 2016

Discovered

Jun 14, 2016

Filed

vs. sector median

6 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed600 affectedView incident

Name: Texas Health and Human Services Commission
norm: texas health and human services commission
Industry: Insurance — Health

Name: Texas Health and Human Services Commission
norm: texas health and human services commission
Industry: Insurance — Health
Industry: Healthcaresource defaultGovernmentllm

Discovered: May 10, 2016
Breach occurred: Apr 19, 2016 – May 10, 2016
Undetected for: 21 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 600nationwide
Data types: Identity (basic)Government IDHealth (basic)Financial account
HHS breach type: Loss
Where the data lived: Paper / films
Covered-entity type: Health planBusiness associate involved
Attack vector: Unauthorized Access
Threat actor: Partner
Regulator citations: HHS OCR — breach notification submitted; OCR obtained assurances of corrective action implementation
Third party: via Iron Mountain

During the incident: Breach notification provided to HHS, affected individuals, and the media
Business associate retrained its workforce members on privacy and appropriate storage and tracking procedures
CE initiated a change to its procedure for reconciling file inventories and verifying file box destruction
Changes made: Iron Mountain workforce retrained on privacy and appropriate storage/tracking procedures
Updated procedure for reconciling file inventories and verifying file box destruction
OCR obtained assurances that corrective actions were implemented
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(35 days from discovery to filing)
Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: May 10, 2016
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: May 10, 2016
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: May 10, 2016 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: May 10, 2016 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jun 14, 2016
Raw hash: ce2dc93b25c338efbe8e8fb054ece9c210d24b394c4f06eff1090867b07ecf11

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.9 KB

Download View at source

Reporting entityTexas Health and Human Services Commission

Victim entityTexas Health and Human Services Commission

Incidentdiscovered May 10, 2016

Stated responseBreach notification provided to HHS, affected individuals, and the media

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing