NEW JERSEYHackingHealthcareHealthcareBusiness Associate (HIPAA)Customer Data InvolvedData ExfiltratedIdentity (basic)Government IDHealth (basic)CriticalResolved

Continuum Health Alliance

bd_a76511431956e7f5 · schema v1 · pii pii-v1

Severity

Critical

Discovered

Mar 8, 2024

Filed

Apr 1, 2024

To disclose

—

Affected

377,119

Linked

8 filings

Confidence

94%

Full breach record for Continuum Health Alliance →

Continuum Health Alliance, LLC (NJ), a business associate, reported to HHS OCR on 2024-04-01 a Hacking/IT Incident affecting 377,119 individuals. Breached information was located on a Network Server. Exposed PHI included names, addresses, dates of birth, Social Security numbers, drivers' license numbers, diagnoses/conditions, and other treatment information. The BA notified HHS, media, and affected individuals, provided substitute notice, offered credit monitoring, and implemented additional administrative, technical, and security safeguards.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 24 days

Mar 8, 2024

Discovered

Apr 1, 2024

Filed

This filing is one of 8 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

Indiana State AGbd_6b9b2a5170b221182024-04-29 · +28dVerified
Montana State AGbd_639cd43912c2df852024-04-30 · +29dCandidate
Maine State AGbd_c6fec7754655a23a2024-04-30 · +29dVerified
Massachusetts State AGbd_df43f1f768b63a082024-04-30 · +29dVerified

Show 3 more filings ↓up to 142d gap

Maine State AGbd_503197057db5f2902024-08-21 · +142dVerified
Vermont State AGbd_573f2fd8faa2ee632024-08-21 · +142dVerified
New Hampshire State AGbd_c33c3f11f79dba5e2024-08-21 · +142dVerified

Name: Continuum Health Alliance
norm: continuum health alliance
Industry: Business Associate

Name: Continuum Health Alliance
norm: continuum health alliance
Industry: Business Associate
Industry: Healthcaresource default

Discovered: Mar 8, 2024
Materiality determined: —
Notification sent: —
Affected individuals: 377,119nationwide
Data types: Identity (basic)Government IDHealth (basic)
HHS breach type: Hacking / IT incident
Where the data lived: Network server
Covered-entity type: Business associate
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: HHS OCR breach notification submitted

During the incident: Notified HHS
Notified media
Notified affected individuals
Provided substitute notice
Provided complimentary credit monitoring services to affected individuals
Changes made: Implemented additional administrative safeguards
Implemented additional technical safeguards
Implemented additional security safeguards to better protect PHI
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Mar 8, 2024
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Mar 8, 2024
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Mar 8, 2024 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Mar 8, 2024 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

HHS OCRApr 1 · first · this page

Indiana State AG+28d

Montana State AG+29d

Maine State AG+29d

Massachusetts State AG+29d

Maine State AG+142d

Vermont State AG+142d

New Hampshire State AG+142d

Pattern: first filing Apr 1 (NJ), last Aug 21 (NH) — a 142-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 1, 2024
Raw hash: 146b1d0d8d2ee8817fe50588c6723a3f415bcf4bced2d4a1c4c143440b3090d9

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.6 KB

Download View at source

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityContinuum Health Alliance

Victim entityContinuum Health Alliance

Incidentdiscovered Mar 8, 2024

Stated responseNotified HHS

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing