CALIFORNIAPhysicalHealthcareProfessional ServicesHealthcareTheftBusiness Associate (HIPAA)Customer Data InvolvedIdentity (basic)Government IDFinancial accountHealth (basic)MediumResolved

Jackson Lewis

bd_b61502b887ceaf50 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Feb 17, 2023

To disclose

—

Affected

986

Linked

12 filings

Confidence

98%

Full breach record for Jackson Lewis →3 incidents on file

Jackson Lewis P.C., a business associate (law firm), reported to HHS on 2023-02-17 a theft of two hard drives affecting 986 individuals. Breached information was located on other portable electronic devices and included names, dates of birth, SSNs, financial and claims information, health insurance information, diagnoses, and other treatment information. The BA notified HHS, affected individuals, the media, and provided substitute notice, free credit monitoring, and additional physical, administrative, and technical safeguards. OCR provided technical assistance.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Feb 17, 2023

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 12 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (10) · sorted by filing gap

California State AGbd_a99ede413afc86c72023-02-17Verified
New Hampshire State AGbd_64efaf67a1c46a372023-01-25 · +23dVerified
Vermont State AGbd_0fde3fc4947bfd512023-03-16 · +27dVerified
California State AGbd_36a72583dcda602b2023-03-16 · +27dVerified

Show 6 more filings ↓up to 195d gap

Maine State AGbd_9d03f1e270b374922023-03-16 · +27dVerified
Massachusetts State AGbd_016cb3f75905233f2023-01-20 · +28dVerified
California State AGbd_31d8496094b8a9942023-01-20 · +28dVerified
Indiana State AGbd_8cd8c657e4c9b6cc2023-01-20 · +28dVerified
New Hampshire State AGbd_ddf5bc42f4f20a9e2023-03-20 · +31dVerified
California State AGbd_b11c716baaed44512023-08-31 · +195dVerified

Showing first 10 of 11 linked disclosures.

Name: Jackson Lewis
norm: jackson lewis
Domain: jacksonlewis.com

Name: Jackson Lewis
norm: jackson lewis
Domain: jacksonlewis.com
Industry: Healthcaresource defaultProfessional Servicesllm

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 986nationwide
Data types: Identity (basic)Government IDFinancial accountHealth (basic)
HHS breach type: Theft
Where the data lived: Portable electronic device
Covered-entity type: Business associate
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: OCR technical assistance provided
Third party: via Jackson Lewis P.C.business associate

During the incident: Notified HHS
Notified affected individuals
Notified media
Provided substitute notice
Provided free credit monitoring
Changes made: Implemented additional physical safeguards
Implemented additional administrative safeguards
Implemented additional technical safeguards
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 11 filings · 6 states

View merged incident ↗

Massachusetts State AGJan 20 · first

California State AGJan 20 · first

Indiana State AGJan 20 · first

New Hampshire State AG+5d

California State AG+28d

HHS OCR+28d · this page

Vermont State AG+55d

California State AG+55d

Maine State AG+55d

New Hampshire State AG+59d

California State AG+223d

Pattern: first filing Jan 20 (MA), last Aug 31 (CA) — a 223-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Cascade drawn from the first 10 linked disclosures of 11 — the full spread may be wider.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 17, 2023
Raw hash: c81c69a5bc870d9f4fa02885a8f3b1b94463a241cae489d0ca2b91b8a469adc6

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.6 KB

Download View at source

Linked disclosures

Regulatory filings (10) · sorted by filing gap

Reporting entityJackson Lewis

Victim entityJackson Lewis

IncidentUnauthorized Access

Stated responseNotified HHS

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing