INDIANAHackingHealthcareTechnologyHealthcareStolen CredentialsBusiness Associate (HIPAA)Customer Data InvolvedData ExfiltratedHealth (basic)Identity (basic)HighResolved

Medical Informatics Engineering, LLC

bd_c89bcf483c5d09e4 · schema v1 · pii pii-v1

Severity

High

Discovered

May 26, 2015

Filed

Jul 23, 2015

To disclose

8 weeks

Affected

3,500,000

Linked

7 records

Confidence

96%

Full breach record for Medical Informatics Engineering, LLC →2 incidents on file

Medical Informatics Engineering, Inc. (MIE), an Indiana-based business associate providing software and electronic medical record services, reported to HHS OCR on July 23, 2015 a Hacking/IT Incident affecting approximately 3,500,000 individuals. Hackers used a compromised user ID and password to access ePHI stored on Electronic Medical Records and Network Servers. OCR found MIE failed to conduct a comprehensive risk analysis prior to the breach. MIE paid a $100,000 settlement and agreed to a corrective action plan including an enterprise-wide risk analysis.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered May 26, 2015 → Notified Jul 23, 201558d ✓ HHS report on time8 weeks discovery → filing

Incident timeline

discovery → filing · 8 weeks / 58 days

May 26, 2015

Discovered

Jul 23, 2015

Filed

vs. sector median

1 wks faster

This filing is one of 7 records about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (5) · sorted by filing gap

New Hampshire State AGbd_b69401d90d3e78842015-07-15 · +8dVerified
California State AGbd_09ef90b2209ecb872015-06-26 · +27dCandidate
South Carolina State AGbd_2fa58541856deea52015-06-24 · +29dVerified
Massachusetts State AGbd_85c12c459cf35bf22015-06-23 · +30dVerified

Show 1 more filing ↓up to 34d gap

New Hampshire State AGbd_b3f9c01949b0815b2015-06-19 · +34dVerified by operator

Enforcement records (1)

HHS OCR enforcementbd_f7b328d96e972d202019-05-23 · +1400dVerified by operator

Name: Medical Informatics Engineering, LLC
norm: medical informatics engineering
Domain: mieweb.com
Industry: Business Associate

Name: Medical Informatics Engineering, LLC
norm: medical informatics engineering
Domain: mieweb.com
Industry: Business Associate
Industry: Healthcaresource defaultTechnologyllm

Discovered: May 26, 2015
Materiality determined: —
Notification sent: Jul 23, 2015
Affected individuals: 3,500,000nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: Hacking / IT incident
Where the data lived: Electronic medical recordNetwork server
Covered-entity type: Business associate
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1041 Exfiltration Over C2 Channel
Threat actor: External
Regulator citations: HHS OCR investigation$100,000 settlement payment to HHS OCRCorrective Action Plan including enterprise-wide risk analysis
Initial access: valid_credentials

During the incident: Filed breach report with HHS OCR on July 23, 2015
Agreed to corrective action plan
Paid $100,000 settlement to HHS OCR
Changes made: Enterprise-wide risk analysis
Corrective Action Plan under HIPAA Rules
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: HHS report on time · 58dHHS notified
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: May 26, 2015
→ Notified: Jul 23, 2015
58d 60 days HHS report on time
HIPAA
Discovered: May 26, 2015
→ Notified: Jul 23, 2015
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: May 26, 2015 → Notified: Jul 23, 2015	58d	60 days	HHS report on time
HIPAA	Discovered: May 26, 2015 → Notified: Jul 23, 2015	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 6 filings · 5 states

View merged incident ↗

New Hampshire State AGJun 19 · first

Massachusetts State AG+4d

South Carolina State AG+5d

California State AG+7d

New Hampshire State AG+26d

HHS OCR+34d · this page

Pattern: first filing Jun 19 (NH), last Jul 23 (IN) — a 34-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jul 23, 2015
Raw hash: 8a8e0602d0fc9ae750983bdeb1a622af17225f89b166a5eef8e82304e6a989b9

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.6 KB

Download View at source

Linked disclosures

Regulatory filings (5) · sorted by filing gap

Enforcement records (1)

Reporting entityMedical Informatics Engineering, LLC

Victim entityMedical Informatics Engineering, LLC

Incidentdiscovered May 26, 2015

Stated responseFiled breach report with HHS OCR on July 23, 2015

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing