PhysicalHealthcareHealthcareTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)PHIMediumContained

AMEDISYS, INC.

bd_8c4828bb74c5b368 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 23, 2015

Filed

Mar 2, 2015

To disclose

7 days

Affected

31state residents only

Linked

3 filings

Confidence

66%

Full breach record for AMEDISYS, INC. →3 incidents on file

Amedisys, Inc. notified the New Hampshire Attorney General of a breach involving lost or unlocated laptops/computers containing patient PII and PHI. The incident was discovered during an inventory process completed on Feb 23, 2015. Approximately 31 NH residents were affected. Notifications began Feb 28, 2015, offering credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 237 days

discovery → filing · 7 days

Jul 1, 2014

Begins

Feb 23, 2015

Discovered

Mar 2, 2015

Filed

vs. sector median

8 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_131827e29580fc232015-03-01 · +1dVerified
Massachusetts State AGbd_27012ff06c335e942015-03-04 · +2dVerified

Name: AMEDISYS, INC.
norm: amedisys
Domain: amedisys.com

Name: AMEDISYS, INC.
norm: amedisys
Domain: amedisys.com
Industry: Healthcarellm

Discovered: Feb 23, 2015
Breach occurred: Jul 1, 2014 – Feb 23, 2015
Undetected for: 237 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 28, 2015
Affected individuals: 31state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: Internal
Regulator citations: Notified New Hampshire Department of Justice
Initial access: insider_action

During the incident: Began sending notification letters to affected residents
Offering free credit monitoring and identity theft protection services to potentially affected patients
Improving the way it tracks devices to ensure it maintains an updated device inventory
Reinforcing existing policies and practices
Implementing additional safeguards
Changes made: Improving the way it tracks devices to ensure it maintains an updated device inventory
Reinforcing existing policies and practices
Implementing additional safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRMar 1 · first

New Hampshire State AG+1d · this page

Massachusetts State AG+3d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/amedisys-20150302.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 2, 2015
Raw hash: 96cf55b31ecc5d65301a9b9ddf0838dc44a4821a0fc147fcf3976de2f9d353a9

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityAMEDISYS, INC.

Victim entityAMEDISYS, INC.

Incidentdiscovered Feb 23, 2015

Stated responseBegan sending notification letters to affected residents

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov