IOWAAccidentalHealthcareHealthcareMisdeliveryBusiness Associate (HIPAA)Customer Data InvolvedDelayed DiscoveryPHIHealth (basic)Identity (basic)LowResolved

Iowa Medicaid Enterprise

bd_b1c1b5f7360330bb · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Apr 25, 2014

To disclose

—

Affected

862

Confidence

67%

Full breach record for Iowa Medicaid Enterprise →2 incidents on file

Iowa Medicaid Enterprise reported to HHS on 2014-04-25 a Unauthorized Access/Disclosure affecting 862 individuals. Breached information located on Paper/Films. The incident occurred over a period of nine years from 2005 to 2014. The entity conducted internal investigations, sanctioned employees, provided security awareness training, and implemented new HIPAA policies and procedures.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline

Jan 1, 2005

Begins

Apr 25, 2014

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed862 affectedView incident

Name: Iowa Medicaid Enterprise
norm: iowa medicaid enterprise
Industry: Insurance — Health

Name: Iowa Medicaid Enterprise
norm: iowa medicaid enterprise
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Breach occurred: Jan 1, 2005 – Dec 31, 2014
Materiality determined: —
Notification sent: —
Affected individuals: 862nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Paper / films
Covered-entity type: Health plan
Attack vector: Unauthorized Access
MITRE ATT&CK: T1530 Data from Cloud Storage
Threat actor: Internal
Regulator citations: self-reported to OCR-HQ (as required by 45 CFR § 164.408(b))HHS, Office for Civil Rights (OCR), Midwest Region initiated a review

During the incident: Conducted multiple internal investigations
Sanctioned the employees involved in the breach incidents
Provided training to its staff on its policies and procedures regarding Security Awareness
Implemented annual security control reviews
Implemented new HIPAA policies and procedures
Changes made: Performed risk analysis and corresponding risk management plan
Implemented annual security control reviews that assess compliance with Privacy, Security, and Breach Notification Rules
Implemented new HIPAA policies and procedures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 25, 2014
Raw hash: 42c0dc8be789d853f6f9ef1a970eebd74b35bc15e184ead8ffea3df6c64899c2

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.1 KB

Download View at source

Reporting entityIowa Medicaid Enterprise

Victim entityIowa Medicaid Enterprise

IncidentUnauthorized Access

Stated responseConducted multiple internal investigations

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing