NEW YORKPhysicalHealthcareHealthcareTheftLossCustomer Data InvolvedPatch Available Not AppliedPHIHealth (basic)Identity (basic)HighResolved

University of Rochester

bd_731fa826b7ecfbf4 · schema v1 · pii pii-v1

Severity

High

Financial impact

$3.00M

Discovered

—

Filed

May 22, 2015

To disclose

—

Affected

3,403

Confidence

96%

Full breach record for University of Rochester →5 incidents on file

University of Rochester Medical Center and Affiliates reported to HHS OCR on 2015-05-22 an Unauthorized Access/Disclosure affecting 3,403 individuals via loss of an unencrypted flash drive (2013) and theft of an unencrypted laptop (2017). OCR found URMC failed to implement encryption and risk analysis. URMC agreed to pay $3 million and undertook a corrective action plan with two years of HIPAA compliance monitoring.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

May 22, 2015

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3,403 affectedView incident

Name: University of Rochester
norm: university of rochester
Domain: rochester.edu
Industry: Health Care Services

Name: University of Rochester
norm: university of rochester
Domain: rochester.edu
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 3,403nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Paper / films
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: URMC filed breach report with OCR in 2013 following loss of unencrypted flash driveURMC filed breach report with OCR in 2017 following theft of unencrypted laptopOCR investigated URMC in 2010 concerning a similar breach involving a lost unencrypted flash drive and provided technical assistanceOCR investigated and found URMC failed to conduct enterprise-wide risk analysis, implement sufficient security measures, utilize device and media controls, and employ encryption mechanismsURMC agreed to pay $3 million to OCR to settle potential HIPAA Privacy and Security Rules violationsURMC undertook a corrective action plan including two years of monitoring compliance with HIPAA Rules

During the incident: Filed breach reports with OCR in 2013 and 2017
Agreed to pay $3 million to OCR to settle potential HIPAA violations
Changes made: Undertook a corrective action plan that includes two years of monitoring their compliance with the HIPAA Rules
Required to conduct enterprise-wide risk analysis
Required to implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level
Required to utilize device and media controls
Required to employ a mechanism to encrypt and decrypt electronic protected health information (ePHI)
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: May 22, 2015
Raw hash: c2a7bb680a412749c9a52a861697b9641ba0b38791a9b0a6f145e8dc9dd78836

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html3.1 KB

Download View at source

Reporting entityUniversity of Rochester

Victim entityUniversity of Rochester

IncidentUnauthorized Access

Stated responseFiled breach reports with OCR in 2013 and 2017

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing