MisuseHealthcareProfessional ServicesHealthcarePrivilege AbuseCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Health (basic)PIILowContained

Med Associates Inc.

bd_d8013243e54ffb6c · schema v1 · pii pii-v1

Severity

Low

Discovered

Mar 22, 2018

Filed

Jun 14, 2018

To disclose

12 weeks

Affected

6state residents only

Linked

4 filings

Confidence

64%

Full breach record for Med Associates Inc. →

Med Associates, Inc. notified patients of a data security incident discovered on March 22, 2018, involving unauthorized access to an employee workstation. Potentially exposed data included patient names, DOBs, addresses, diagnosis codes, and insurance IDs. No financial or banking data was involved. The company secured the workstation, engaged forensic investigators, and offered one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 weeks / 84 days

Mar 22, 2018

Begins

Mar 22, 2018

Discovered

Jun 14, 2018

Filed

vs. sector median

1 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

HHS OCRbd_6bc937def01368a22018-06-14Verified
New Hampshire State AGbd_8b67f0737ee765fb2018-06-14Verified
Massachusetts State AGbd_f0966ba194ae363b2018-06-14Verified

Name: Med Associates Inc.
norm: med associates
Domain: med-associates.com

Name: Med Associates Inc.
norm: med associates
Domain: med-associates.com
Industry: HealthcarellmProfessional Servicesllm

Discovered: Mar 22, 2018
Breach occurred: Mar 22, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 7, 2018
Affected individuals: 6state-resident count only
Data types: Identity (basic)Health (basic)PII
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Initial access: insider_action

During the incident: Immediately began investigating with our IT vendor
Retained a leading third-party forensic investigation firm to assist with our investigation
Secured the impacted workstation
Implemented even more stringent information security standards
Increased staff training on data privacy and security
Offering you access to one year of credit monitoring and identity theft restoration services through TransUnion at no cost to you
Changes made: Implemented even more stringent information security standards
Increased staff training on data privacy and security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 12 weeks(84 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

HHS OCRJun 14 · first

New Hampshire State AGJun 14 · first

Massachusetts State AGJun 14 · first

Montana State AGJun 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/Med-Associates.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 14, 2018
Raw hash: 7f2a1cd70dcac2e2b1ddfdea4ae8014e682a58af42c1e60b3c1a44b51518e160

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityMed Associates Inc.

Victim entityMed Associates Inc.

Incidentdiscovered Mar 22, 2018

Stated responseImmediately began investigating with our IT vendor

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov