FLORIDAAccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedEmployee Data InvolvedHealth (basic)Identity (basic)Financial accountMediumResolved

mdINR LLC

bd_afc3b23c18c86a34 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 3, 2014

Filed

Jan 5, 2015

To disclose

9 weeks

Affected

1,859

Confidence

95%

Full breach record for mdINR LLC →

mdINR LLC (FL) reported to HHS OCR on 2015-01-05 an Unauthorized Access/Disclosure affecting 1,859 individuals. On November 3, 2014, an IT employee sent an unsecured email with an attached spreadsheet containing PHI (patient names, billing account numbers, reporting dates, internal site codes, and facility addresses) to a manufacturer representative. Breached information was located in Email. The employee received a written warning; the CE reinforced HIPAA training and role-based access controls. OCR obtained assurances of corrective action.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified9 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 9 weeks / 63 days

Nov 3, 2014

Begins

Nov 3, 2014

Discovered

Jan 5, 2015

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,859 affectedView incident

Name: mdINR LLC
norm: mdinr
Industry: Health Care Services

Name: mdINR LLC
norm: mdinr
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Nov 3, 2014
Breach occurred: Nov 3, 2014
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,859nationwide
Data types: Health (basic)Identity (basic)Financial account
HHS breach type: Unauthorized access or disclosure
Where the data lived: Email
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1048 Exfiltration Over Alternative Protocol
Threat actor: Internal
Regulator citations: HHS OCR — breach notification submitted; OCR obtained assurances of corrective actions implemented
Initial access: insider_action

During the incident: Breach notification submitted to HHS OCR
Individual notifications sent to 1,859 affected patients
Media notice not provided (fewer than 500 affected individuals in any one state)
Changes made: Sanctioned responsible employee with written warning
Confirmed HIPAA Training provided to all new employees within 30 days of hiring
Safeguarded data by providing system access based on employee job title or role
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(63 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Nov 3, 2014
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Nov 3, 2014 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jan 5, 2015
Raw hash: 20ec75f0bdebd9c748914d4129e759cf2f04e0aea8d0a280887fd6da82709d59

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.0 KB

Download View at source

Reporting entitymdINR LLC

Victim entitymdINR LLC

Incidentdiscovered Nov 3, 2014

Stated responseBreach notification submitted to HHS OCR

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing