NEW YORKPhysicalHealthcareFinancial ServicesHealthcareTheftBusiness Associate (HIPAA)Customer Data InvolvedHealth (basic)Identity (basic)Financial accountMediumResolved

Senior Health Partners

bd_d9c68f632d8076fa · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Feb 6, 2015

To disclose

—

Affected

2,772

Confidence

97%

Full breach record for Senior Health Partners →

Senior Health Partners, a Healthfirst company (NY Health Plan), reported to HHS on 2015-02-06 a Theft affecting 2,772 individuals. A bag containing a laptop and smartphone was stolen from an employee of business associate Premier Home Care Services, Inc. The devices contained ePHI including demographic, clinical, and health claims information. The CE notified affected individuals and offered free credit monitoring; law enforcement was contacted and a forensic investigation conducted. The BA was suspended for six months and entered a Security Assessment and Remediation Plan. Location of breached info: Laptop, Other Portable Electronic Device.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Feb 6, 2015

Filed

—

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,772 affectedView incident

Name: Senior Health Partners
norm: senior health
Industry: Insurance — Health

Name: Senior Health Partners
norm: senior health
Industry: Insurance — Health
Industry: Healthcaresource defaultFinancial Servicesllm

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 2,772nationwide
Data types: Health (basic)Identity (basic)Financial account
HHS breach type: Theft
Where the data lived: LaptopPortable electronic device
Covered-entity type: Health plan
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: HHS OCR breach notification submittedOCR obtained assurances that the BA implemented corrective actions
Third party: via Premier Home Care Services, Inc.business associate

During the incident: Breach notification sent to HHS, media, health plan clients, and affected individuals
Posted notice on CE website
Offered free credit monitoring to affected individuals
Contacted law enforcement
Conducted forensic investigation
Sanctioned BA including six-month suspension of services
BA entered into Security Assessment and Remediation Plan
Changes made: BA required to implement new/updated IT security policies and procedures
BA required to conduct a risk analysis and implement a remediation plan
BA required to implement policies and procedures relating to information system activity review, security incident response and reporting, access and audit controls, and creating/maintaining retrievable exact copies of ePHI
OCR obtained assurances of corrective action implementation
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 6, 2015
Raw hash: 58435ff87626b1888b5a0ac628c59bf51aa0413ee702c0dc7206979ff9e4921f

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.4 KB

Download View at source

Reporting entitySenior Health Partners

Victim entitySenior Health Partners

IncidentUnauthorized Access

Stated responseBreach notification sent to HHS, media, health plan clients, and affected individuals

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing