NEW YORKAccidentalHealthcareFinancial ServicesHealthcareMisdeliveryCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)HighResolved

WILLIS NORTH AMERICA INC.

bd_ee1b0a75f296a2f0 · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Apr 24, 2014

To disclose

—

Affected

4,830

Linked

3 filings

Confidence

97%

Full breach record for WILLIS NORTH AMERICA INC. →2 incidents on file

Willis North America Inc. Medical Expense Benefit Plan (NY, Health Plan) reported to HHS on 2014-04-24 an Unauthorized Access/Disclosure affecting 4,830 individuals. A group health plan administrator accidentally emailed 1,889 plan participants a spreadsheet containing PHI of 4,830 participants, including names, dates of birth, and Social Security numbers. Breached information located in Email. No business associate was involved. The CE took extensive corrective action including deleting the email from inboxes, sanctioning the administrator, updating HIPAA training, and offering two years of identity theft protection.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Apr 24, 2014

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Massachusetts State AGbd_542164c507117ae12014-04-22 · +2dVerified
New Hampshire State AGbd_cc28a57ab3fb9b892014-04-17 · +7dCandidate

Name: WILLIS NORTH AMERICA INC.
norm: willis north america
Industry: Insurance — Health

Name: WILLIS NORTH AMERICA INC.
norm: willis north america
Industry: Insurance — Health
Industry: Healthcaresource defaultFinancial Servicesllm

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 4,830nationwide
Data types: Identity (basic)Government IDHealth (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Email
Covered-entity type: Health plan
Attack vector: Unauthorized Access
Threat actor: Internal
Regulator citations: HHS OCR notified; OCR obtained assurances CE implemented corrective actions; CE expected to conduct risk analysis and implement remediation plan per Security Rule; CE to revise plan documents to comply with Privacy Rule.
Initial access: insider_action

During the incident: Blocked recipients' ability to forward the email
Deleted the email from recipients' inboxes
Instructed recipients to delete the email and not save or forward it
Tracked all instances of recipients forwarding the email prior to block
Obtained assurances from recipients that PHI was deleted and not used improperly
Sanctioned the plan administrator responsible
Instructed workforce members to follow new PHI handling protocols including encryption and password-protecting attachments
Adopted HIPAA policies and procedures relating to PHI handling
Updated HIPAA training
Completed assessment of e-PHI maintained and transmitted
Offered two years of identity theft protection to affected individuals at no cost
Changes made: Encrypt and password-protect attachments with sensitive information prior to transmission
Use secure shared drives instead of emailing PHI where possible
Conduct a risk analysis and implement a corresponding remediation plan per Security Rule
Revise plan documents to comply with the Privacy Rule
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGApr 17 · first

Massachusetts State AG+5d

HHS OCR+7d · this page

Pattern: first filing Apr 17 (NH), last Apr 24 (NY) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 24, 2014
Raw hash: ff2b740b4e07c70c15fa672ed295bde4cb7c9a1c8369c60afa5f39b35890e6f8

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.8 KB

Download View at source

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWILLIS NORTH AMERICA INC.

Victim entityWILLIS NORTH AMERICA INC.

IncidentUnauthorized Access

Stated responseBlocked recipients' ability to forward the email

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing