MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedDelayed DiscoveryIdentity (basic)Government IDHealth (basic)PHIMediumContained

Med Center Health

bd_6f8be1882ea4b573 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 4, 2017

Filed

Mar 24, 2017

To disclose

11 weeks

Affected

24state residents only

Linked

3 filings

Confidence

66%

Full breach record for Med Center Health →

Med Center Health, a subsidiary of Commonwealth Health Corporation, notified the NH Attorney General of an insider breach involving a former employee who inappropriately obtained billing information (names, SSNs, health insurance, diagnosis codes) of approximately 24 NH residents between Aug 2014 and Feb 2015. Discovery was Jan 4, 2017. Notification was delayed per law enforcement request until March 2017. Remediation included staff education and credit monitoring offers.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 887 days

discovery → filing · 11 weeks / 79 days

Aug 1, 2014

Begins

Jan 4, 2017

Discovered

Mar 24, 2017

Filed

vs. sector median

on median

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_aa2ceec7a94f06c42017-03-24Verified
Massachusetts State AGbd_cca98de35a390ccc2017-03-24Verified

Name: Commonwealth Health Corporation
norm: commonwealth health

Name: Med Center Health
norm: med center health
Industry: Healthcarellm

Discovered: Jan 4, 2017
Breach occurred: Aug 1, 2014 – Feb 28, 2015
Undetected for: 887 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 24, 2017
Affected individuals: 24state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: InternalSecondary
Regulator citations: Notified New Hampshire Office of the Attorney GeneralReported matter to law enforcement
Initial access: insider_action

During the incident: Reporting the matter to law enforcement
Offering one year of complementary credit monitoring and identity protection services through Experian
Establishing a dedicated call center for affected individuals
Changes made: Reinforcing education with its staff regarding its strict policies and procedures in maintaining the confidentiality of patient information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(79 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGMar 24 · first

Massachusetts State AGMar 24 · first

New Hampshire State AGMar 24 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/commonwealth-health-20170324.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 24, 2017
Raw hash: 327e8b25731f5a91f981a5a1412dfe43152a28a3e995f3cb93f9acd0fa4849c0

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCommonwealth Health Corporation

Victim entityMed Center Health

Incidentdiscovered Jan 4, 2017

Stated responseReporting the matter to law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov