GEORGIAPhysicalHealthcareHealthcareTheftBusiness Associate (HIPAA)Customer Data InvolvedDelayed DiscoveryHealth (basic)Identity (basic)MediumResolved

LifeGas

bd_830413579b43e933 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 11, 2012

Filed

Feb 4, 2013

To disclose

17 weeks

Affected

1,103

Confidence

97%

Full breach record for LifeGas →

LifeGas, a business associate of covered entity American Home Patient Inc., reported to HHS on 2013-02-04 a Theft affecting 1,103 individuals. On October 11, 2012, an employee lost or misplaced an unencrypted laptop containing ePHI (names, addresses, oxygen supply indicator) for 1,103 clients across 13 states. A simultaneously misplaced thumb drive was confirmed to contain no PHI. The CE investigated, notified HHS and affected individuals, and renegotiated the BA agreement with stricter breach notification timeframe provisions. OCR confirmed completion of corrective actions.

J jump to incidentP pin to compareR raw source

HIPAA clock✗ HHS report late17 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 17 weeks / 116 days

Oct 11, 2012

Begins

Oct 11, 2012

Discovered

Feb 4, 2013

Filed

vs. sector median

+4 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,103 affectedView incident

Name: LifeGas
norm: lifegas

Name: LifeGas
norm: lifegas
Industry: Healthcaresource default

Discovered: Oct 11, 2012
Breach occurred: Oct 11, 2012
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,103nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: Theft
Where the data lived: Laptop
Covered-entity type: Business associate
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: Internal
Regulator citations: HHS OCR breach notification submitted; OCR obtained assurances CE completed corrective actions
Third party: via LifeGas (Business Associate of American Home Patient Inc.)business associate

During the incident: Internal investigation conducted by covered entity (American Home Patient Inc.)
Breach notification provided to HHS and affected individuals
New agreement negotiated with business associate (LifeGas) including stringent provisions for future breach notification timeframes
OCR obtained assurances that corrective actions were completed
Changes made: Negotiated updated BA agreement with stricter breach notification timeframe provisions
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(116 days from discovery to filing)
Compliance flags: HHS report lateHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Oct 11, 2012
→ Notified: not extracted
— 60 days HHS report late
HIPAA
Discovered: Oct 11, 2012
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Oct 11, 2012 → Notified: not extracted	—	60 days	HHS report late
HIPAA	Discovered: Oct 11, 2012 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 4, 2013
Raw hash: 3ca2b6db9dadc7d28dba3ec243f208f8d4b5a5697e8471df6376f5bd9f0e1ee2

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.8 KB

Download View at source

Reporting entityLifeGas

Victim entityLifeGas

Incidentdiscovered Oct 11, 2012

Stated responseInternal investigation conducted by covered entity (American Home Patient Inc.)

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing