NEW YORKAccidentalHealthcareHealthcareMisconfigurationCustomer Data InvolvedHealth (basic)Identity (basic)Financial accountMediumResolved

The Arc of Erie County

bd_8bdd9ce4e5256d61 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Mar 9, 2018

To disclose

—

Affected

3,751

Confidence

95%

Full breach record for The Arc of Erie County →

The Arc of Erie County (NY) reported to HHS OCR on 2018-03-09 an Unauthorized Access/Disclosure affecting 3,751 individuals. Two spreadsheets containing PHI (demographic, clinical, and health insurance information) were inadvertently made publicly accessible via the internet due to a security protection failure on an internal hyperlink on the CE's website. The CE notified HHS, affected individuals, and the media. Remediation included disabling the exposed hyperlinks, engaging Avalon for HIPAA compliance review and managed detection/response, hiring a new IT director, and deploying patch management and intrusion detection software. OCR confirmed corrective actions were implemented.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Mar 9, 2018

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3,751 affectedView incident

Name: The Arc of Erie County
norm: the arc of erie county
Industry: Health Care Services

Name: The Arc of Erie County
norm: the arc of erie county
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 3,751nationwide
Data types: Health (basic)Identity (basic)Financial account
HHS breach type: Unauthorized access or disclosure
Where the data lived: Network server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1530 Data from Cloud Storage
Regulator citations: HHS OCR — breach notification submitted; OCR obtained assurances that corrective actions were implemented

During the incident: Turned off internet access to hyperlinks containing PHI
Engaged Avalon for comprehensive HIPAA compliance review (data privacy, security, IT policies and procedures)
Engaged Avalon for ongoing managed detection and response services
Hired a new IT director
Purchased and implemented patch management software
Implemented intrusion detection software
Engaged HarpData to conduct a risk assessment of its IT system
Changes made: Disabled public internet access to internal hyperlinks containing PHI
Patch management software deployed to reduce vulnerabilities
Intrusion detection software implemented
Comprehensive HIPAA compliance review initiated
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Mar 9, 2018
Raw hash: 72beea7aa74b26d875a7da6248203f7a81a9d61e33822464b5dbd10b8cb3a02c

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.1 KB

Download View at source

Reporting entityThe Arc of Erie County

Victim entityThe Arc of Erie County

IncidentUnauthorized Access

Stated responseTurned off internet access to hyperlinks containing PHI

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing