MASSACHUSETTSAccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowResolved

Boston Health Care for the Homeless Program

bd_7140b2c4e9293ebf · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 6, 2018

Filed

Sep 7, 2018

To disclose

≤1 day

Affected

861

Confidence

66%

Full breach record for Boston Health Care for the Homeless Program →6 incidents on file

Boston Health Care for the Homeless Program reported to HHS on 2018-09-07 a Unauthorized Access/Disclosure affecting 861 individuals. Breached information located on Paper/Films. The clinic door was left unlocked after hours; a shelter guest was found in an exam room. No evidence the guest accessed PHI, but demographic and clinical data was stored in the clinic. OCR investigated, provided technical assistance, and the entity updated policies, retrained staff, and implemented additional safeguards.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Sep 6, 2018 → Notified Sep 7, 20181d ✓ HHS report on time≤1 day discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1 days

discovery → filing · ≤1 day / 1 days

Sep 5, 2018

Begins

Sep 6, 2018

Discovered

Sep 7, 2018

Filed

vs. sector median

12 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed861 affectedView incident

Name: Boston Health Care for the Homeless Program
norm: boston health care for the homeless program
Industry: Health Care Services

Name: Boston Health Care for the Homeless Program
norm: boston health care for the homeless program
Industry: Healthcaresource default

Discovered: Sep 6, 2018
Breach occurred: Sep 5, 2018 – Sep 5, 2018
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: Sep 7, 2018
Affected individuals: 861nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Paper / films
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: OCR provided technical assistance to the CE regarding the timeliness requirements for notification to OCR and individualsOCR reviewed the CE’s relevant policies and procedures

During the incident: Notified potentially affected individuals pursuant to the Breach Notification Rule
Updated a relevant administrative safeguards policy
Retrained staff on the revisions
Implemented additional physical and technical safeguards
Changes made: Updated a relevant administrative safeguards policy
Retrained staff on the revisions
Implemented additional physical and technical safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(1 days from discovery to filing)
Compliance flags: HHS report on time · 1dHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Sep 6, 2018
→ Notified: Sep 7, 2018
1d 60 days HHS report on time
HIPAA
Discovered: Sep 6, 2018
→ Notified: Sep 7, 2018
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Sep 6, 2018 → Notified: Sep 7, 2018	1d	60 days	HHS report on time
HIPAA	Discovered: Sep 6, 2018 → Notified: Sep 7, 2018	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Sep 7, 2018
Raw hash: aa7e264a944f80415fa5a58adfb7a8b33bb1ab92eae3e44ec0c83ee9e3714403

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.9 KB

Download View at source

Reporting entityBoston Health Care for the Homeless Program

Victim entityBoston Health Care for the Homeless Program

Incidentdiscovered Sep 6, 2018

Stated responseNotified potentially affected individuals pursuant to the Breach Notification Rule

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing