AZMalwareHealthcareHealthcareRansomwareData EncryptedRansom DemandedCustomer Data InvolvedHEALTH_BASICIDENTITY_BASICMediumResolved
Northwest Rheumatology
bd_96cbeaa072efb00f · schema v1 · pii pii-v1
Full breach record for Northwest Rheumatology →Northwest Rheumatology (AZ) reported to HHS on 2017-07-31 a Hacking/IT Incident (ransomware) affecting 7,468 individuals. On April 10, 2017, ransomware encrypted a limited portion of the CE's network server, potentially exposing ePHI including clinical and demographic information. In response to OCR's investigation, the CE strengthened password requirements, implemented new technical safeguards, revised business associate contracts, and retrained staff.
HIPAA clock✓ HHS notified16 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed7,468 affectedView incident
Source provenance
- Source URL
- https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
- Filed at
- Jul 31, 2017
- Raw hash
- c6eaab04b84f12d6c8f54c88a40675eb639ef5517a928a43412fccb38544660f
Source filing
AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.
Reporting entity
- Name
- Northwest Rheumatologynorm: northwest rheumatology
- Industry
- Health Care Services
Victim entity
- Name
- Northwest Rheumatologynorm: northwest rheumatology
- Industry
- Health Care Services
- Industry
- Healthcaresource default
Incident
- Discovered
- Apr 10, 2017
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- 7,468
- Data types
- HEALTH_BASICIDENTITY_BASIC
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1486 Data Encrypted for Impact
- Threat actor
- ExternalFinancial
- Regulator citations
- HHS OCR investigation completed
Compliance
- Time to disclose
- 16 weeks(112 days from discovery to filing)
- Compliance flags
- HHS notified
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
- Clock breakdown
Statute Window Elapsed Threshold Status HIPAA Discovered: Apr 10, 2017→ Notified: not extracted— regulatory submission HHS notified
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.