NEW YORKMisuseHealthcareHealthcarePrivilege AbuseCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)MediumResolved

Comprehensive Care Management Corporation

bd_f5d5513b972e9ff5 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 14, 2010

To disclose

—

Affected

1,020

Confidence

68%

Full breach record for Comprehensive Care Management Corporation →

Comprehensive Care Management Corporation reported to HHS on 2010-06-14 a Theft affecting 1020 individuals. Breached information located on Desktop Computer, Email, Laptop, Network Server. Two former employees sent ePHI to personal accounts to open a competitor.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Jun 14, 2010

Filed

—

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,020 affectedView incident

Name: Comprehensive Care Management Corporation
norm: comprehensive care management
Industry: Insurance — Health

Name: Comprehensive Care Management Corporation
norm: comprehensive care management
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 1,020nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Theft
Where the data lived: Desktop computerEmailLaptopNetwork server
Covered-entity type: Health plan
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: InternalSecondary
Regulator citations: OCR opened an investigation of the covered entity
Initial access: insider_action

During the incident: Conducted an internal inquiry
Entered into an agreement with its competitor who hired the former employees to return or destroy the ePHI
Changes made: Replaced and strengthened external firewalls
Restricted access to email websites
Restricted the use of portable devices
Limited the ability to upload data to external websites
Evaluated new monitor and control software for network information
Provided training to all staff on its HIPAA policies and procedures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jun 14, 2010
Raw hash: b37186ab35efc85e641e97b42e79f2664fdf2fb8e55bdbba9ee2f4e5b97dc2e6

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.0 KB

Download View at source

Reporting entityComprehensive Care Management Corporation

Victim entityComprehensive Care Management Corporation

IncidentUnauthorized Access

Stated responseConducted an internal inquiry

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing