INDIANAHackingHealthcareTechnologyHealthcareStolen CredentialsBusiness Associate (HIPAA)Customer Data InvolvedData ExfiltratedHealth (basic)Identity (basic)HighResolved

Medical Informatics Engineering, LLC

bd_c89bcf483c5d09e4 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 23, 2015

Filed

Jul 23, 2015

To disclose

—

Affected

3,500,000

Linked

6 filings

Confidence

96%

Full breach record for Medical Informatics Engineering, LLC →2 incidents on file

Medical Informatics Engineering, Inc. (MIE), an Indiana-based business associate providing software and electronic medical record services, reported to HHS OCR on July 23, 2015 a Hacking/IT Incident affecting approximately 3,500,000 individuals. Hackers used a compromised user ID and password to access ePHI stored on Electronic Medical Records and Network Servers. OCR found MIE failed to conduct a comprehensive risk analysis prior to the breach. MIE paid a $100,000 settlement and agreed to a corrective action plan including an enterprise-wide risk analysis.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jul 23, 2015 → Notified Jul 23, 20150d ✓ HHS report on time

⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Incident timeline

discovery → filing · ≤1 day / 0 days

Jul 23, 2015

Discovered

Jul 23, 2015

Filed

This filing is one of 6 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_b69401d90d3e78842015-07-15 · +8dVerified
California State AGbd_09ef90b2209ecb872015-06-26 · +27dCandidate
South Carolina State AGbd_2fa58541856deea52015-06-24 · +29dVerified
Massachusetts State AGbd_85c12c459cf35bf22015-06-23 · +30dVerified

Show 1 more filing ↓up to 1400d gap

HHS OCR enforcementbd_f7b328d96e972d202019-05-23 · +1400dVerified by operator

Name: Medical Informatics Engineering, LLC
norm: medical informatics engineering
Domain: mieweb.com
Industry: Business Associate

Name: Medical Informatics Engineering, LLC
norm: medical informatics engineering
Domain: mieweb.com
Industry: Business Associate
Industry: Healthcaresource defaultTechnologyllm

Discovered: Jul 23, 2015
Materiality determined: —
Notification sent: Jul 23, 2015
Affected individuals: 3,500,000nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: Hacking / IT incident
Where the data lived: Electronic medical recordNetwork server
Covered-entity type: Business associate
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: HHS OCR investigation$100,000 settlement payment to HHS OCRCorrective Action Plan including enterprise-wide risk analysis
Initial access: valid_credentials

During the incident: Filed breach report with HHS OCR on July 23, 2015
Agreed to corrective action plan
Paid $100,000 settlement to HHS OCR
Changes made: Enterprise-wide risk analysis
Corrective Action Plan under HIPAA Rules
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS report on time · 0dHHS notified
Discovery-date grounding: notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jul 23, 2015
→ Notified: Jul 23, 2015
0d 60 days HHS report on time
HIPAA
Discovered: Jul 23, 2015
→ Notified: Jul 23, 2015
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jul 23, 2015 → Notified: Jul 23, 2015	0d	60 days	HHS report on time
HIPAA	Discovered: Jul 23, 2015 → Notified: Jul 23, 2015	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

Massachusetts State AGJun 23 · first

South Carolina State AG+1d

California State AG+3d

New Hampshire State AG+22d

HHS OCR+30d · this page

HHS OCR enforcement+1430d

Pattern: first filing Jun 23 (MA), last May 23 — a 1430-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jul 23, 2015
Raw hash: 8a8e0602d0fc9ae750983bdeb1a622af17225f89b166a5eef8e82304e6a989b9

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.6 KB

Download View at source

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Reporting entityMedical Informatics Engineering, LLC

Victim entityMedical Informatics Engineering, LLC

Incidentdiscovered Jul 23, 2015

Stated responseFiled breach report with HHS OCR on July 23, 2015

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing