FEDERALPhysicalHealthcareFinancial ServicesHealthcareLossCustomer Data InvolvedBusiness Associate (HIPAA)HEALTH_BASICIDENTITY_BASICIDENTITY_GOVERNMENTHighResolved

OptumHealth New Mexico

bd_c3ee12e0c71a122e · schema v1 · pii pii-v1

Full breach record for OptumHealth New Mexico →

OptumHealth New Mexico (Health Plan, MN) reported to HHS OCR on 2016-11-18 a Loss affecting 2,006 individuals. An unencrypted USB flash drive containing ePHI was mailed by business associate Rothstein, Donatelli, Hughes, Dahlstrom, Schoenburg & Bienvenu (a law firm) on September 16, 2016 and lost or accidentally destroyed within the USPS system; discovered September 26, 2016. ePHI included names, addresses, dates of birth, provider names, diagnoses, plan ID, and partial/full SSNs for 169 individuals. CE ceased new business with BA as of January 1, 2017; OCR opened a separate BA review.

HIPAA clock✓ HHS notified8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,006 affectedView incident

Source provenance

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Nov 18, 2016
Raw hash: 195af1a6b2c6d4e0cdcb7b2a88149f795fbc30a8b78e4427e0bc67110f6b20e5

Source filing

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.8 KB

Download View at source

Reporting entity

Name: OptumHealth New Mexico
norm: optumhealth new mexico
Industry: Insurance — Health

Victim entity

Name: OptumHealth New Mexico
norm: optumhealth new mexico
Industry: Insurance — Health
Industry: Healthcaresource defaultFinancial Servicesllm

Incident

Discovered: Sep 26, 2016
Materiality determined: —
Notification sent: —
Affected individuals: 2,006
Data types: HEALTH_BASICIDENTITY_BASICIDENTITY_GOVERNMENT
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: Partner
Regulator citations: OCR obtained documentation of corrective action; OCR is opening a separate review of the BA.
Third party: via Rothstein, Donatelli, Hughes, Dahlstrom, Schoenburg & Bienvenubusiness associate

Compliance

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Sep 26, 2016
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Sep 26, 2016 → Notified: not extracted	—	regulatory submission	HHS notified

Extraction provenance

Status: No extraction artifact recorded for this disclosure.