PhysicalHealthcareHealthcareTheftCustomer Data InvolvedPHIIdentity (basic)Health (basic)LowResolved

EqualizeRCM Systems

bd_bc6ef2ee0289ad7f · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 29, 2016

Filed

Apr 28, 2016

To disclose

8 weeks

Affected

2state residents only

Linked

3 filings

Confidence

65%

Full breach record for EqualizeRCM Systems →

EqualizeRCM Systems, a healthcare billing vendor, reported the theft of an employee laptop containing patient records. The incident occurred between Feb 25-26, 2016, and was discovered on Feb 29, 2016. Two New Hampshire residents were affected. Data included names, DOBs, medical record numbers, and insurance info, but not SSNs or financial accounts. The company notified law enforcement, offered identity monitoring, and implemented policy reviews and employee retraining.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 4 days

discovery → filing · 8 weeks / 59 days

Feb 25, 2016

Begins

Feb 29, 2016

Discovered

Apr 28, 2016

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Montana State AGbd_04e7049280fc21442016-04-28Candidate
Oregon State AGbd_d757cbc966e8e4ac2016-05-06 · +8dVerified

Name: EqualizeRCM Systems
norm: equalizercm systems

Name: EqualizeRCM Systems
norm: equalizercm systems
Industry: Healthcarellm

Discovered: Feb 29, 2016
Breach occurred: Feb 25, 2016 – Feb 26, 2016
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 28, 2016
Affected individuals: 2state-resident count only
Data types: PHIIdentity (basic)Health (basic)
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Notified New Hampshire Attorney General as a courtesy

During the incident: Began an investigation to determine how this happened and what information may have been impacted
Informed law enforcement about this incident
Provided 12 months of identity monitoring and identity restoration services through AllClear ID
Changes made: Reviewing its policies and procedures
Implementing additional safeguards to ensure information in its control is appropriately protected
Retraining its employees on its policies for the proper handling of sensitive information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Montana State AGApr 28 · first

New Hampshire State AGApr 28 · first · this page

Oregon State AG+8d

Pattern: first filing Apr 28 (MT), last May 6 (OR) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/equalizercm-systems-20160428.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 28, 2016
Raw hash: cc41d1036cbb52af5809e3556292071d2b26a380be77305a445d602304228899

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityEqualizeRCM Systems

Victim entityEqualizeRCM Systems

Incidentdiscovered Feb 29, 2016

Stated responseBegan an investigation to determine how this happened and what information may have been impacted

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov