MASSACHUSETTSSocial EngineeringHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedHealth (basic)Identity (basic)Financial accountMediumResolved

Reliable Respiratory

bd_e5709ee6a4d92708 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 2, 2018

Filed

Sep 1, 2018

To disclose

9 weeks

Affected

21,311

Linked

4 filings

Confidence

97%

Full breach record for Reliable Respiratory →

Reliable Respiratory (MA) reported to HHS on 2018-09-01 a Hacking/IT Incident (phishing) affecting 21,311 individuals. On June 28, 2018, a phishing email compromised an employee's email account; discovered July 2, 2018. PHI exposed included demographic, clinical, and financial information via Email. The CE notified HHS, affected individuals, and media; provided credit monitoring; and is implementing email encryption, enhanced inbound filters, and multifactor authentication per OCR's guidance.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 4 days

discovery → filing · 9 weeks / 61 days

Jun 28, 2018

Begins

Jul 2, 2018

Discovered

Sep 1, 2018

Filed

vs. sector median

on median

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Massachusetts State AGbd_15428dd70672ee5d2018-10-23 · +52dVerified
Montana State AGbd_28a6e8acbcd217312018-10-23 · +52dVerified
New Hampshire State AGbd_c3987bb4b54a02a02018-10-29 · +58dVerified

Name: Reliable Respiratory
norm: reliable respiratory
Industry: Health Care Services

Name: Reliable Respiratory
norm: reliable respiratory
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Jul 2, 2018
Breach occurred: Jun 28, 2018
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 21,311nationwide
Data types: Health (basic)Identity (basic)Financial account
HHS breach type: Hacking / IT incident
Where the data lived: Email
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1566 PhishingT1078 Valid Accounts
Threat actor: External
Regulator citations: OCR investigation conducted; assurances of corrective action obtained
Initial access: phishing_link

During the incident: Breach notification to HHS, affected individuals, and media
Call-center number established
Free credit monitoring provided
Changes made: Email encryption solutions implemented
More stringent inbound email filters targeted at catching and quarantining suspicious emails
Multifactor authentication implemented
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jul 2, 2018
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jul 2, 2018 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

HHS OCRSep 1 · first · this page

Massachusetts State AG+52d

Montana State AG+52d

New Hampshire State AG+58d

Pattern: first filing Sep 1 (MA), last Oct 29 (NH) — a 58-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Sep 1, 2018
Raw hash: 5f7b1dfe972b0c54978dcc54f17a5a8c00b31c30d2b37741cd5abdec3a98093e

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.8 KB

Download View at source

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityReliable Respiratory

Victim entityReliable Respiratory

Incidentdiscovered Jul 2, 2018

Stated responseBreach notification to HHS, affected individuals, and media

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing