NORTH CAROLINAPhysicalHealthcareHealthcareLossCustomer Data InvolvedHealth (basic)Identity (basic)Government IDHighResolved

New Dimension Group, LLC

bd_83caf51354a18a74 · schema v1 · pii pii-v1

Severity

High

Discovered

Sep 29, 2015

Filed

Nov 25, 2015

To disclose

8 weeks

Affected

1,275

Confidence

97%

Full breach record for New Dimension Group, LLC →

New Dimension Group, LLC (NC, Healthcare Provider) reported to HHS OCR on 2015-11-25 the loss of three unencrypted flash drives discovered missing on September 29, 2015, affecting 1,275 individuals. Exposed PHI included names, dates of birth, Social Security numbers, driver's license numbers, and clinical information. The CE banned flash drive use, implemented device-control policies, deployed email-encryption software, and provided 12 months of free credit monitoring. OCR obtained assurances of corrective action completion.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time8 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 8 weeks / 57 days

Sep 29, 2015

Begins

Sep 29, 2015

Discovered

Nov 25, 2015

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,275 affectedView incident

Name: New Dimension Group, LLC
norm: new dimension
Industry: Health Care Services

Name: New Dimension Group, LLC
norm: new dimension
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Sep 29, 2015
Breach occurred: Sep 29, 2015
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,275nationwide
Data types: Health (basic)Identity (basic)Government ID
HHS breach type: Loss
Where the data lived: Portable electronic device
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: HHS OCR notified; OCR obtained assurances of corrective actions implemented.

During the incident: Timely breach notification to HHS, affected individuals, and on entity website.
Media notification issued to the Duplin Times and the Star News.
Free credit monitoring provided to affected individuals for 12 months.
Banned the use of flash drives.
Developed policies and procedures for media and device controls.
Updated policies and procedures to protect patient PHI.
Purchased new software to encrypt emails containing PHI.
Trained employees on updated policies and procedures.
Changes made: Flash drive use prohibited organization-wide.
Media and device control policies developed.
Email encryption software deployed for PHI communications.
Employee training on PHI safeguard policies.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(57 days from discovery to filing)
Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Sep 29, 2015
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Sep 29, 2015
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Sep 29, 2015 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Sep 29, 2015 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Nov 25, 2015
Raw hash: 5eff0da2410207d999fc379fd424dabd0578eeb92e3c143ae15c4dcc779f4d69

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.0 KB

Download View at source

Reporting entityNew Dimension Group, LLC

Victim entityNew Dimension Group, LLC

Incidentdiscovered Sep 29, 2015

Stated responseTimely breach notification to HHS, affected individuals, and on entity website.

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing