norm: the arc of erie countyno LEI · no CIKMax severity: Medium

Canonical registry

The Arc of Erie County

ent_07660eee41438f38f919d382

Compliance scorecard →🔔 Follow entity

Disclosures

1

HHS OCR · 1 jurisdiction

Incidents

—

no linked incident in sample

Max affected reported

3,751

as filed · HHS OCR NY

Leak-site claims

0

none in sample

Identity resolution

Canonical name: The Arc of Erie County
Normalized: the arc of erie county— dedupe via name-norm; Microsoft / MSFT collapse to one row
GLEIF LEI: No match
SEC EDGAR CIK: None — not an SEC registrant
Domain: None on record

Disclosure history (1)newest first

NEW YORKHHS OCRas victim2018-03-09
The Arc of Erie County (NY) reported to HHS OCR on 2018-03-09 an Unauthorized Access/Disclosure affecting 3,751 individuals. Two spreadsheets containing PHI (demographic, clinical, and health insurance information) were inadvertently made publicly accessible via the internet due to a security protection failure on an internal hyperlink on the CE's website. The CE notified HHS, affected individuals, and the media. Remediation included disabling the exposed hyperlinks, engaging Avalon for HIPAA compliance review and managed detection/response, hiring a new IT director, and deploying patch management and intrusion detection software. OCR confirmed corrective actions were implemented.