AccidentalHealthcareTechnologyHealthcareMisconfigurationData MishandlingSupply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryPHIHealth (basic)Identity (basic)Government IDFinancialMediumContained

BioTel Heart

bd_80973f0a43e0f28c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 28, 2021

Filed

Mar 26, 2021

To disclose

8 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

BioTel Heart notified customers that a third-party vendor failed to secure medical records stored online, potentially exposing them to the public between October 17, 2019, and August 9, 2020. The incident was discovered on January 28, 2021. Affected data included names, contact info, dates of birth, medical diagnoses, treatments, health insurance info, and potentially Social Security numbers. BioTel terminated the vendor relationship and offered two years of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 469 days

discovery → filing · 8 weeks / 57 days

Oct 17, 2019

Begins

Jan 28, 2021

Discovered

Mar 26, 2021

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

Massachusetts State AGbd_c9e34074c8e9579c2021-03-26Verified

Name: BioTel Heart
norm: biotel heart

Name: BioTel Heart
norm: biotel heart
Industry: HealthcarellmTechnologyllm

Discovered: Jan 28, 2021
Breach occurred: Oct 17, 2019 – Aug 9, 2020
Undetected for: 469 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Government IDFinancial
Data elements: Date of birthMedical information
Attack vector: Third-Party / Supply Chain
Third party: via Vendor

During the incident: Immediately took steps to investigate and respond to this incident
Confirmed that as of August 9, 2020, the vendor secured the information it stored online on our behalf
Terminated the business arrangement with the vendor responsible for this incident
Will require the vendor to securely delete all copies of the records after they securely provide them to us
Offering a complimentary two-year membership of Equifax Credit Watch Gold, which includes credit monitoring and identity restoration services
Changes made: Terminated the business arrangement with the vendor responsible for this incident
Will require the vendor to securely delete all copies of the records
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

Massachusetts State AGMar 26 · first

California State AGMar 26 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-539524
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 26, 2021
Raw hash: 979576cf771b3ca3e54f03fa0481447cc8880b506cb05788fdb4900ed408f644

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityBioTel Heart

Victim entityBioTel Heart

Incidentdiscovered Jan 28, 2021

Stated responseImmediately took steps to investigate and respond to this incident

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov