FLORIDAMisuseHealthcareHealthcarePrivilege AbuseStolen CredentialsBusiness Associate (HIPAA)Customer Data InvolvedPHIHealth (basic)Identity (basic)MediumResolved

WellCare Health Plans, Inc.

bd_d8f905708e59ed30 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 10, 2018

Filed

Jun 13, 2018

To disclose

9 weeks

Affected

1,101

Confidence

67%

Full breach record for WellCare Health Plans, Inc. →6 incidents on file

WellCare Health Plans, Inc. reported to HHS on 2018-06-13 an Unauthorized Access/Disclosure affecting 1101 individuals. An employee of business associate Advanced Medical Reviews (AMR) used stolen physician credentials to access PHI, including demographic and clinical information. WellCare notified HHS, individuals, and regulators, provided credit monitoring, and implemented corrective actions.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 9 weeks / 64 days

Apr 10, 2018

Discovered

Jun 13, 2018

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,101 affectedView incident

Name: WellCare Health Plans, Inc.
norm: wellcare health plans
Industry: Insurance — Health

Name: WellCare Health Plans, Inc.
norm: wellcare health plans
Industry: Insurance — Health
Industry: Healthcaresource default

Discovered: Apr 10, 2018
Materiality determined: —
Notification sent: —
Affected individuals: 1,101nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Other
Covered-entity type: Health planBusiness associate involved
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: InternalFinancial
Regulator citations: Notified HHSNotified relevant state and federal regulatorsOCR obtained assurances that the CE implemented the corrective actions
Third party: via Advanced Medical Reviewsbusiness associate
Initial access: valid_credentials

During the incident: Provided breach notification to HHS, affected individuals, and the media
Established a toll-free information line
Provided free credit monitoring
Conducted a full examination of the incident
Reviewed the impostor’s medical decisions
Worked closely with the BA to determine the extent of the breach
Notified the relevant state and federal regulators
Changes made: Implemented corrective actions
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Apr 10, 2018
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Apr 10, 2018 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jun 13, 2018
Raw hash: 3338eef9a70f5c7ccf5c6d8056831dd25308fa7d242354924efa894674a503de

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.0 KB

Download View at source

Reporting entityWellCare Health Plans, Inc.

Victim entityWellCare Health Plans, Inc.

Incidentdiscovered Apr 10, 2018

Stated responseProvided breach notification to HHS, affected individuals, and the media

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing