NEW YORKMisuseHealthcareHealthcarePrivilege AbuseKnowledge AbuseCustomer Data InvolvedData ExfiltratedTargetedDelayed DiscoveryHealth (basic)Identity (basic)Government IDCriticalResolved

MONTEFIORE MEDICAL CENTER

bd_a87192afde76d3d2 · schema v1 · pii pii-v1

Severity

Critical

Financial impact

$4.75M

Discovered

May 1, 2015

Filed

Jul 22, 2015

To disclose

12 weeks

Affected

12,517

Linked

2 filings

Confidence

91%

Full breach record for MONTEFIORE MEDICAL CENTER →11 incidents on file

Montefiore Medical Center (NYC non-profit hospital system) reported to HHS OCR on 2015-07-22 a Theft breach affecting 12,517 individuals. An employee stole ePHI from electronic medical records approximately two years prior (c. 2013) and sold it to an identity theft ring over a ~6-month period. NYPD notified Montefiore in May 2015. HHS OCR investigation resulted in a $4.75 million settlement and a corrective action plan. No business associate was involved.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered May 1, 2015 → Notified Jul 22, 2015✓ HHS notified12 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 730 days

discovery → filing · 12 weeks / 82 days

May 1, 2013

Begins

May 1, 2015

Discovered

Jul 22, 2015

Filed

vs. sector median

1 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCR enforcementbd_6542af964bdcd01a2024-02-06 · +3121dVerified by operator

Name: MONTEFIORE MEDICAL CENTER
norm: montefiore medical center
Domain: montefiore.org
Industry: Health Care Services

Name: MONTEFIORE MEDICAL CENTER
norm: montefiore medical center
Domain: montefiore.org
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: May 1, 2015
Breach occurred: May 1, 2013 – Nov 1, 2013
Undetected for: 730 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 22, 2015
Affected individuals: 12,517nationwide
Data types: Health (basic)Identity (basic)Government ID
HHS breach type: Theft
Where the data lived: Electronic medical record
Covered-entity type: Healthcare provider
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1052 Exfiltration Over Physical Medium
Threat actor: InternalFinancial
Regulator citations: HHS OCR settlement: $4,750,000 monetary penaltyCorrective action plan implementedOCR monitoring period: 2 years
Initial access: insider_action

During the incident: Internal investigation conducted after NYPD notification in May 2015
Breach report filed with HHS OCR
Corrective action plan developed and implemented
Changes made: Conducting an accurate and thorough risk assessment
Developing a written risk management plan
Implementing hardware, software, and/or procedural mechanisms to record and examine activity in all information systems
Reviewing and revising written HIPAA policies and procedures
Providing workforce training on HIPAA policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(82 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: May 1, 2015
→ Notified: Jul 22, 2015
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: May 1, 2015 → Notified: Jul 22, 2015	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRJul 22 · first · this page

HHS OCR enforcement+3121d

Pattern: first filing Jul 22 (NY), last Feb 6 — a 3121-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jul 22, 2015
Raw hash: 4442b8e3737cca1d93551e580e522ac927ae538ab7d50c530c97d4c556d6bc2c

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html4.7 KB

Download View at source

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMONTEFIORE MEDICAL CENTER

Victim entityMONTEFIORE MEDICAL CENTER

Incidentdiscovered May 1, 2015

Stated responseInternal investigation conducted after NYPD notification in May 2015

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing