MISSOURIMisuseHealthcareHealthcarePrivilege AbuseData MishandlingBusiness Associate (HIPAA)Data ExfiltratedCustomer Data InvolvedDelayed DiscoveryPHIIdentity (basic)Government IDHealth (basic)HighResolved

Centene Management Corporation

bd_ea3dd49699c731f0 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 8, 2015

Filed

Oct 15, 2015

To disclose

7 days

Affected

8,208

Confidence

92%

Full breach record for Centene Management Corporation →

An employee of business associate Centene Management Company downloaded data files containing PHI of 8,208 individuals to an unauthorized removable storage device before resigning. The employee returned a company-issued laptop on 2015-03-23, but it was not connected to the network for processing per standard procedure, delaying detection. On 2015-10-08, a data loss prevention tool discovered the impermissible downloads when the laptop was finally connected. PHI included names, addresses, dates of birth, medical ID numbers, and in some cases SSNs. Affected members were enrollees of covered entities Bridgeway Health Solutions and Superior Health Plan. The BA notified HHS, affected individuals, and media, and provided substitute notice. Remediation included new IT-equipment processing policy and DLP controls preventing downloads to unauthorized external storage. OCR provided technical assistance on Security Rule risk analysis/management.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Oct 8, 2015 → Notified Oct 15, 20157d ✓ HHS report on time7 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 7 days

Oct 8, 2015

Discovered

Oct 15, 2015

Filed

vs. sector median

10 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed8,208 affectedView incident

Name: Centene Management Corporation
norm: centene management
Industry: Health Plan

Name: Centene Management Corporation
norm: centene management
Industry: Health Plan
Industry: Healthcaresource default

Discovered: Oct 8, 2015
Materiality determined: —
Notification sent: Oct 15, 2015
Affected individuals: 8,208nationwide
Data types: PHIIdentity (basic)Government IDHealth (basic)
HHS breach type: Theft
Where the data lived: Portable electronic device
Covered-entity type: Health plan
Attack vector: Insider
Threat actor: Internal
Regulator citations: HHS OCR breach report filed 2015-10-15OCR provided technical assistance regarding Security Rule risk analysis and risk management

During the incident: Notification to HHS, affected individuals, and the media
Substitute notice provided
Changes made: Implemented policy ensuring timely processing of returned IT equipment
Implemented policy and software solution prohibiting downloads to unauthorized external storage
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: HHS report on time · 7dHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Oct 8, 2015
→ Notified: Oct 15, 2015
7d 60 days HHS report on time
HIPAA
Discovered: Oct 8, 2015
→ Notified: Oct 15, 2015
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Oct 8, 2015 → Notified: Oct 15, 2015	7d	60 days	HHS report on time
HIPAA	Discovered: Oct 8, 2015 → Notified: Oct 15, 2015	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Oct 15, 2015
Raw hash: e88bb247e9f544e7b842a45600054c834d7391a40526ebbde2c3004a72861e46

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.4 KB

Download View at source

Reporting entityCentene Management Corporation

Victim entityCentene Management Corporation

Incidentdiscovered Oct 8, 2015

Stated responseNotification to HHS, affected individuals, and the media

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing