HackingHealthcareHealthcareCustomer Data InvolvedPHIIdentity (basic)Health (basic)LowContained

Med Associates Inc.

bd_8b67f0737ee765fb · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 22, 2018

Filed

Jun 14, 2018

To disclose

12 weeks

Affected

10state residents only

Linked

4 filings

Confidence

67%

Full breach record for Med Associates Inc. →

Med Associates, Inc. notified the NH Attorney General of an incident where an unauthorized party accessed an employee's workstation on March 22, 2018. The breach potentially exposed PHI (name, DOB, address, dates of service, diagnosis/procedure codes, insurance info) for 10 New Hampshire residents. The company secured the workstation, engaged forensic investigators, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 84 days

Mar 22, 2018

Discovered

Jun 14, 2018

Filed

vs. sector median

1 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_6bc937def01368a22018-06-14Verified
Montana State AGbd_d8013243e54ffb6c2018-06-14Verified
Massachusetts State AGbd_f0966ba194ae363b2018-06-14Verified

Name: Med Associates, Inc.
norm: med associates

Name: Med Associates Inc.
norm: med associates
Domain: med-associates.com
Industry: Healthcarellm

Discovered: Mar 22, 2018
Materiality determined: —
Notification sent: Jun 14, 2018
Affected individuals: 10state-resident count only
Data types: PHIIdentity (basic)Health (basic)
Attack vector: Unauthorized Access
Threat actor: External
Regulator citations: Notified New Hampshire Attorney General

During the incident: Immediately began investigating with our IT vendor
Retained a leading third-party forensic investigation firm to assist with our investigation
Secured the impacted workstation
Notified Data Owners on May 18, 2018
Posted notice of the incident on its website on May 22, 2018
Provided written notice of this incident to all affected individuals
Changes made: Implemented even more stringent information security standards
Increased staff training on data privacy and security
Providing access to credit monitoring services for one (1) year, through Trans Union
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(84 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRJun 14 · first

Montana State AGJun 14 · first

Massachusetts State AGJun 14 · first

New Hampshire State AGJun 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/med-associates-20180614.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 14, 2018
Raw hash: 48c7d00dfa60d2b5be837452b9c13fcb80d5a7a0d0403e5eb0363262fd1d5a3c

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMed Associates, Inc.

Victim entityMed Associates Inc.

Incidentdiscovered Mar 22, 2018

Stated responseImmediately began investigating with our IT vendor

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov