NEW YORKHackingHealthcareHealthcareBusiness Associate (HIPAA)Customer Data InvolvedDelayed DiscoveryHealth (basic)Identity (basic)HighResolved

Northeast Radiology

bd_ae55b2108f5ede74 · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Mar 11, 2020

To disclose

—

Affected

298,532

Linked

4 filings

Confidence

95%

Full breach record for Northeast Radiology →

Northeast Radiology, P.C. (NERAD) reported to HHS OCR on 2020-03-11 a Hacking/IT Incident affecting 298,532 individuals. Between April 2019 and January 2020, unauthorized individuals accessed radiology images stored on NERAD's PACS (Picture Archiving and Communication System) network server. OCR's investigation found NERAD failed to conduct a required risk analysis. NERAD paid a $350,000 settlement and entered a two-year corrective action plan as the 6th enforcement action under OCR's Risk Analysis Initiative.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline

Apr 1, 2019

Begins

Mar 11, 2020

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_78fd7616737985cb2020-03-11Verified
Massachusetts State AGbd_f306b619c132c28f2020-03-11Verified
HHS OCR enforcementbd_0f3fa12d8c2e6fa02025-04-04 · +1850dVerified by operator

Name: Northeast Radiology
norm: northeast radiology
Industry: Health Care Services

Name: Northeast Radiology
norm: northeast radiology
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Breach occurred: Apr 1, 2019 – Jan 31, 2020
Materiality determined: —
Notification sent: —
Affected individuals: 298,532nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: Hacking / IT incident
Where the data lived: Network server
Covered-entity type: Healthcare providerBusiness associate involved
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1530 Data from Cloud Storage
Threat actor: External
Regulator citations: HHS OCR investigation opened March 2020 following breach reportOCR Risk Analysis Initiative — 6th enforcement actionResolution agreement executed; $350,000 settlement paid to OCRTwo-year corrective action plan (CAP) monitored by OCR
Initial access: exploit_public_facing

During the incident: Notified 298,532 affected patients
Reported breach to HHS OCR in March 2020
Entered resolution agreement with OCR
Paid $350,000 penalty to HHS OCR
Changes made: Conducting accurate and thorough risk analysis of ePHI systems
Developing and implementing a risk management plan to address identified vulnerabilities
Developing process to regularly review information system activity (audit logs, access reports, security incident tracking)
Developing, maintaining, and revising written HIPAA policies and procedures
Augmenting HIPAA and security training for all workforce members with PHI access
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Montana State AGMar 11 · first

Massachusetts State AGMar 11 · first

HHS OCRMar 11 · first · this page

HHS OCR enforcement+1850d

Pattern: first filing Mar 11 (MT), last Apr 4 — a 1850-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Mar 11, 2020
Raw hash: 7db78343efa4454415e50cd90f1ca7a875b676c6f1f04c781359515257b2b0e3

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html4.5 KB

Download View at source

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityNortheast Radiology

Victim entityNortheast Radiology

IncidentUnauthorized Access

Stated responseNotified 298,532 affected patients

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing