VIRGINIAUnknownHealthcareHealthcareError OtherBusiness Associate (HIPAA)Customer Data InvolvedHealth (basic)Identity (basic)Government IDHighResolved

Democracy Data & Communications, LLC (

bd_901281676a19068e · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Dec 8, 2009

To disclose

—

Affected

83,000

Confidence

84%

Full breach record for Democracy Data & Communications, LLC ( →

Democracy Data & Communications, LLC (VA) reported to HHS OCR on 2009-12-08 a breach of type 'Other' affecting 83,000 individuals. Breached information was located on Paper/Films. OCR investigation confirmed the covered entity posed significant risk of financial, reputational, or other harm. Corrective actions included a risk assessment, member notifications with credit monitoring and identity theft insurance, call center training, media outreach to 21 outlets, and implementation of a centralized PHI/PII data security policy with mandatory annual staff training.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Dec 8, 2009

Filed

—

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed83,000 affectedView incident

Name: Democracy Data & Communications, LLC (
norm: democracy data communications

Name: Democracy Data & Communications, LLC (
norm: democracy data communications
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: Dec 18, 2009
Affected individuals: 83,000nationwide
Data types: Health (basic)Identity (basic)Government ID
HHS breach type: Other
Where the data lived: Paper / films
Covered-entity type: Business associate
Attack vector: Unknown
Regulator citations: HHS OCR investigation conducted

During the incident: Individual notification letters issued
Media notification in states with >500 impacted members
Call center trained to handle member inquiries
Changes made: Risk assessment conducted
Notification letters sent to 83,000 members
Free credit monitoring (one year) and identity theft insurance ($25,000; $10,000 for NY residents) offered
Call center training provided on November 29, 2009
Press releases sent to 21 major media outlets on December 18, 2009
New PHI/PII Data Security and Handling Policy implemented, centralizing data requests via 'Team Track' with Privacy Officer and Security Officer sign-off
Mandatory annual computer-based training for all staff in May 2010
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: Dec 18, 2009
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: Dec 18, 2009	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Dec 8, 2009
Raw hash: 24bff380348fbe7c6dbab30f190edcb6f878960734673e527d310f59b12fde26

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.5 KB

Download View at source

Reporting entityDemocracy Data & Communications, LLC (

Victim entityDemocracy Data & Communications, LLC (

IncidentUnknown

Stated responseIndividual notification letters issued

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing