NEW MEXICOPhysicalHealthcareGovernmentHealthcareTheftCustomer Data InvolvedHealth (basic)Identity (basic)LowResolved

New Mexico Department of Health

bd_cf025d550eb6c746 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 4, 2015

Filed

Dec 15, 2015

To disclose

10 weeks

Affected

561

Confidence

97%

Full breach record for New Mexico Department of Health →2 incidents on file

New Mexico Department of Health reported to HHS on 2015-12-15 a Theft affecting 561 individuals. A workforce member's laptop was stolen from her locked vehicle on October 4, 2015. The laptop contained patients' names, dates of birth, diagnoses, and medications. The CE remediated by implementing full disk encryption enterprise-wide, revising security awareness training, and procuring mobile device management and SIEM solutions. OCR obtained assurances of implementation.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified10 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 10 weeks / 72 days

Oct 4, 2015

Begins

Oct 4, 2015

Discovered

Dec 15, 2015

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed561 affectedView incident

Name: New Mexico Department of Health
norm: new mexico department of health
Domain: health.nm.gov
Industry: Health Care Services

Name: New Mexico Department of Health
norm: new mexico department of health
Domain: health.nm.gov
Industry: Health Care Services
Industry: Healthcaresource defaultGovernmentllm

Discovered: Oct 4, 2015
Breach occurred: Oct 4, 2015
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 561nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: Theft
Where the data lived: Laptop
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: OCR obtained assurances from the CE that it implemented the remediation actions listed.

During the incident: Breach notification provided to HHS
Breach notification provided to affected individuals
Changes made: Investigated the incident
Modified procedures to ensure all IT equipment is delivered directly to the IT department
All laptops are automatically encrypted with full disk encryption
Initiated process to identify all laptops across the enterprise lacking full disk encryption
Revised security awareness training to include protection and loss prevention of mobile devices
Procured a mobile device management system
Procured a security event and incident management (SIEM) solution and developed an implementation schedule
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(72 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Oct 4, 2015
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Oct 4, 2015 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Dec 15, 2015
Raw hash: 1a56563397f07c882e208795dcfbd7d427adbb600b99ea0440be25676d4468ba

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.0 KB

Download View at source

Reporting entityNew Mexico Department of Health

Victim entityNew Mexico Department of Health

Incidentdiscovered Oct 4, 2015

Stated responseBreach notification provided to HHS

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing