MASSACHUSETTSAccidentalHealthcareHealthcareMisdeliveryBusiness Associate (HIPAA)Customer Data InvolvedPHIHealth (basic)Identity (basic)MediumResolved

TUFTS ASSOCIATED HEALTH MAINTENANCE ORGANIZATION, INC.

bd_c92b7f16966ee3a0 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 16, 2018

Filed

Feb 16, 2018

To disclose

—

Affected

70,320

Confidence

69%

Full breach record for TUFTS ASSOCIATED HEALTH MAINTENANCE ORGANIZATION, INC. →4 incidents on file

Tufts Associated Health Maintenance Organization, Inc. reported to HHS on 2018-02-16 a Unauthorized Access/Disclosure affecting 70320 individuals. Breached information located on Paper/Films. A business associate (Clarity Software Solutions) prepared a mailing of member ID cards where the member ID number was visible through the envelope window, along with the member’s name and address.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time

⚠ filing dateThe stored discovery date equals the regulator filing date, so no genuine detection date was captured.

Incident timeline

discovery → filing · ≤1 day / 0 days

Feb 16, 2018

Discovered

Feb 16, 2018

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed70,320 affectedView incident

Name: TUFTS ASSOCIATED HEALTH MAINTENANCE ORGANIZATION, INC.
norm: tufts associated health maintenance organization
Industry: Insurance — Health

Name: TUFTS ASSOCIATED HEALTH MAINTENANCE ORGANIZATION, INC.
norm: tufts associated health maintenance organization
Industry: Healthcaresource default

Discovered: Feb 16, 2018
Materiality determined: —
Notification sent: —
Affected individuals: 70,320nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Paper / films
Covered-entity type: Health planBusiness associate involved
Attack vector: Misconfiguration
MITRE ATT&CK: T1530 Data from Cloud Storage
Threat actor: Internal
Regulator citations: OCR’s investigation revealed that the CE and BA had a BA agreement in place at the time of the breachOCR reviewed the BA agreement and determined that it appeared to comply with the requirements of the HIPAA RulesOCR opened a separate review of the BA regarding this incident
Third party: via Clarity Software Solutionsbusiness associate

During the incident: The CE provided breach notification to HHS, the affected individuals, and the media
Changes made: The CE and BA revised their quality control procedures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: filing dateThe stored discovery date equals the regulator filing date, so no genuine detection date was captured.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Feb 16, 2018
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Feb 16, 2018
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Feb 16, 2018 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Feb 16, 2018 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 16, 2018
Raw hash: 46fdbdaef366553ca66649637b6c9e68f83ce0eaf73fd19d76f102a4330baffc

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.7 KB

Download View at source

Reporting entityTUFTS ASSOCIATED HEALTH MAINTENANCE ORGANIZATION, INC.

Victim entityTUFTS ASSOCIATED HEALTH MAINTENANCE ORGANIZATION, INC.

Incidentdiscovered Feb 16, 2018

Stated responseThe CE provided breach notification to HHS, the affected individuals, and the media

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing