FLORIDAPhysicalHealthcareHealthcareTheftCustomer Data InvolvedData ExfiltratedPHIHealth (basic)Government IDIdentity (basic)Financial accountHighResolved

Advanced Data Processing

bd_b703d3e7c429a63f · schema v1 · pii pii-v1

Severity

High

Discovered

Jun 15, 2012

Filed

Nov 29, 2012

To disclose

24 weeks

Affected

12,360

Linked

4 filings

Confidence

65%

Full breach record for Advanced Data Processing →

Advanced Data Processing, Inc. (dba Intermedix) reported to HHS on 2012-11-29 a Theft affecting 12,360 individuals. Breached information located on Desktop Computer. An employee inappropriately accessed and sold patient PHI (names, SSNs, addresses, DOB, claims) to third parties. The CE engaged third-party reviewers, implemented DLP and log management solutions, improved employee training, and launched a vendor management program.

J jump to incidentP pin to compareR raw source

HIPAA clock✗ HHS report late24 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 24 weeks / 167 days

Jun 15, 2012

Begins

Jun 15, 2012

Discovered

Nov 29, 2012

Filed

vs. sector median

+15 wks slower

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_c8eff5dfdde7712d2012-11-30 · +1dVerified
New Hampshire State AGbd_6f310fd6d0967ea02012-11-28 · +1dVerified
California State AGbd_be9c80dd6dbf9a3c2012-11-28 · +1dVerified

Name: Advanced Data Processing
norm: advanced data processing
Industry: Health Care Services

Name: Advanced Data Processing
norm: advanced data processing
Industry: Healthcaresource default

Discovered: Jun 15, 2012
Breach occurred: Jun 15, 2012
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 12,360nationwide
Data types: PHIHealth (basic)Government IDIdentity (basic)Financial account
HHS breach type: Theft
Where the data lived: Desktop computer
Covered-entity type: Healthcare clearinghouse
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1052 Exfiltration Over Physical Medium
Threat actor: InternalFinancial
Regulator citations: Notified HHSOCR obtained assurances that the CE implemented the correction actions listed above
Initial access: insider_action

During the incident: Engaged a third party to review its network environment and make recommendations for security enhancements
Provided breach notification to HHS, affected individuals, and the media and posted substitute notice
Changes made: Implemented data loss prevention technology to identify electronic PHI and block transmittal of sensitive information
Implemented a log management and analysis solution to automate collection, analysis, archival and recovery of log data
Implemented policies and procedures for disposal and reuse of mobile devices, as well as for the secure transport of sensitive information to, from, and between data centers
Created an information security team and appointed a committee to address compliance
Improved its employee training program
Launched a vendor management program to ensure the safeguarding of ePHI by its business associates
Initiated upgrades to its data center security and workstation antivirus technology
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 24 weeks(167 days from discovery to filing)
Compliance flags: HHS report lateHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jun 15, 2012
→ Notified: not extracted
— 60 days HHS report late
HIPAA
Discovered: Jun 15, 2012
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jun 15, 2012 → Notified: not extracted	—	60 days	HHS report late
HIPAA	Discovered: Jun 15, 2012 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGNov 28 · first

California State AGNov 28 · first

HHS OCR+1d · this page

Massachusetts State AG+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Nov 29, 2012
Raw hash: ac2a4c59fa64cbf2a183c54e3c53f95795d347d99e74bd1177247f26028dec0e

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.6 KB

Download View at source

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityAdvanced Data Processing

Victim entityAdvanced Data Processing

Incidentdiscovered Jun 15, 2012

Stated responseEngaged a third party to review its network environment and make recommendations for security enhancements

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing