FLORIDASocial EngineeringHealthcareGovernmentHealthcarePhishingCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)HighResolved

Agency for Health Care Administration

bd_768234dbdf9e75da · schema v1 · pii pii-v1

Severity

High

Discovered

Nov 20, 2017

Filed

Jan 5, 2018

To disclose

7 weeks

Affected

30,000

Confidence

96%

Full breach record for Agency for Health Care Administration →

Agency for Health Care Administration (FL) reported to HHS on 2018-01-05 a Hacking/IT Incident affecting 30,000 individuals. On November 20, 2017, an employee was the victim of a phishing attack, potentially exposing names, dates of birth, addresses, Social Security numbers, and clinical/health insurance information of 29,641 individuals. Breached information was located in Email. OCR obtained assurances that corrective actions, including workforce-wide phishing awareness retraining, were implemented.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time7 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 7 weeks / 46 days

Nov 20, 2017

Discovered

Jan 5, 2018

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed30,000 affectedView incident

Name: Agency for Health Care Administration
norm: agency for health care administration
Domain: ahca.myflorida.com
Industry: Insurance — Health

Name: Agency for Health Care Administration
norm: agency for health care administration
Domain: ahca.myflorida.com
Industry: Insurance — Health
Industry: Healthcaresource defaultGovernmentllm

Discovered: Nov 20, 2017
Materiality determined: —
Notification sent: —
Affected individuals: 30,000nationwide
Data types: Identity (basic)Government IDHealth (basic)
HHS breach type: Hacking / IT incident
Where the data lived: Email
Covered-entity type: Health plan
Attack vector: Unauthorized Access
MITRE ATT&CK: T1566 Phishing
Threat actor: External
Regulator citations: OCR obtained assurances that corrective actions were implemented
Initial access: phishing_link

During the incident: Timely breach notification provided to HHS, affected individuals, and media
Retrained employee at fault on identifying and reporting phishing emails
Retrained entire workforce on identifying and reporting potential phishing emails
Changes made: Employee retraining on HIPAA policies and procedures
Workforce-wide phishing awareness training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(46 days from discovery to filing)
Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Nov 20, 2017
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Nov 20, 2017
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Nov 20, 2017 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Nov 20, 2017 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jan 5, 2018
Raw hash: 3944a95a0c10c60a7014d9ba4974fd5490e39f71c04f701e0897de45ce808f09

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.7 KB

Download View at source

Reporting entityAgency for Health Care Administration

Victim entityAgency for Health Care Administration

Incidentdiscovered Nov 20, 2017

Stated responseTimely breach notification provided to HHS, affected individuals, and media

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing