MASSACHUSETTSPhysicalHealthcareHealthcareTheftCustomer Data InvolvedPHIHealth (basic)MediumResolved

LAHEY CLINIC, INC.

bd_ae28cf69e10e19ac · schema v1 · pii pii-v1

Severity

Medium

Financial impact

$850K

Discovered

Aug 11, 2011

Filed

Oct 11, 2011

To disclose

9 weeks

Affected

599

Confidence

66%

Full breach record for LAHEY CLINIC, INC. →2 incidents on file

Lahey Clinic reported to HHS OCR on 2011-10-11 a Theft affecting 599 individuals. Breached information located on Laptop. A laptop containing PHI of 599 individuals was stolen from an unlocked treatment room on August 11, 2011. Lahey settled potential HIPAA violations for $850,000 and implemented a corrective action plan.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified9 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 9 weeks / 61 days

Aug 11, 2011

Begins

Aug 11, 2011

Discovered

Oct 11, 2011

Filed

vs. sector median

on median

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed599 affectedView incident

Name: LAHEY CLINIC, INC.
norm: lahey clinic
Industry: Health Care Services

Name: LAHEY CLINIC, INC.
norm: lahey clinic
Industry: Healthcaresource default

Discovered: Aug 11, 2011
Breach occurred: Aug 11, 2011 – Aug 11, 2011
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 599nationwide
Data types: PHIHealth (basic)
HHS breach type: Theft
Where the data lived: Laptop
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified HHS Office for Civil Rights (OCR)OCR conducted subsequent investigationEntered into Resolution Agreement and Corrective Action Plan with OCR

During the incident: Agreed to settle potential violations of HIPAA Privacy and Security Rules
Paid $850,000 settlement
Adopted a robust corrective action plan
Provided OCR with a comprehensive, enterprise-wide risk analysis and corresponding risk management plan
Agreed to report certain events and provide evidence of compliance
Changes made: Addressed history of noncompliance with HIPAA Rules
Conducted enterprise-wide risk analysis
Developed corresponding risk management plan
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Aug 11, 2011
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Aug 11, 2011 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Oct 11, 2011
Raw hash: de84b25b20687c3d2e5b1da0ca28011244c6c8cd84cd2a2f3d99a57b3254fea9

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html3.5 KB

Download View at source

Reporting entityLAHEY CLINIC, INC.

Victim entityLAHEY CLINIC, INC.

Incidentdiscovered Aug 11, 2011

Stated responseAgreed to settle potential violations of HIPAA Privacy and Security Rules

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing