HealthFitness
ent_4b4cfe8d57a81349f7de9652
Disclosures
3
HHS OCR · State AG · 2 jurisdictions
Incidents
—
no linked incident in sample
Max affected reported
20,790
as filed · HHS OCR IL
Leak-site claims
0
none in sample
Identity resolution
- Canonical name
- HealthFitness
- Normalized
- healthfitness— dedupe via name-norm; Microsoft / MSFT collapse to one row
- GLEIF LEI
- No match
- SEC EDGAR CIK
- None — not an SEC registrant
- Domain
- None on record
Disclosure history (3)newest first
- ILHHS OCRas victim2019-01-25
HealthFitness reported to HHS on 2019-01-25 a Unauthorized Access/Disclosure affecting 1808 individuals. Breached information located on Other. The incident involved a software misconfiguration on a server housing ePHI, discovered on June 27, 2018. Health Fitness, a business associate, failed to conduct a thorough risk analysis. A $227,816 settlement was reached with OCR.
- ILHHS OCRas victim2018-10-15
HealthFitness (Health Fitness Corporation), a business associate in IL, reported to HHS OCR on 2018-10-15 an Unauthorized Access/Disclosure affecting 20,790 individuals. Beginning approximately August 2015, ePHI became discoverable on the internet due to a software misconfiguration on the server, exposing it to web crawlers. The breach was discovered on June 27, 2018. OCR settled for $227,816 under its Risk Analysis Initiative.
- 🦬Montana State AGas victim2018-10-05
HealthFitness reported a data breach to the Montana Attorney General. The breach was reported on 2018-10-05. The breach occurred from 1/8/2018 to 12/31/2017. 123 Montana residents were affected.