WHAT THIS PACK DOES IN 30 SECONDS

Stop the five leak patterns that cost Blue-class plans hundreds of millions

This pack retunes ORACLE to close the exact gaps that drove the biggest HIPAA settlements on record. It scans every customer portal page for Google Analytics, Meta Pixel, Hotjar, FullStory and 11 other trackers that leak PHI to ad networks. It watches every outbound email for insider exfiltration of SSNs, MRNs, and bulk spreadsheets to personal Gmail or Yahoo. It fingerprints MOVEit, Cleo, GoAnywhere and other file-transfer appliances against live CVE intel so you patch before the next Clop or BlackSuit raid. It cross-checks your vendor list against the real-time list of breached third parties (Conduent, Young Consulting, Cierant, NASCO, Change Healthcare). And it learns your environment round over round, so false positives fall and confidence climbs every week.
PORTAL TRACKER SCAN PHI IN URL INSIDER EMAIL EXFIL FILE-TRANSFER CVE VENDOR BREACH INTEL SELF-LEARNING
DOWNLOAD & SHARE
DOWNLOAD PDF DOWNLOAD DOCX DOWNLOAD MD JSON
P1 · FIX IN 24 HOURS
15
P2 · FIX IN 72 HOURS
4
P3 · NEXT SPRINT
1
TOTAL FINDINGS
20

How priority is computed (multi-factor risk score)

Each finding is scored 0-100 from four factors — Internet-facing · PHI exposure · Exploit-in-wild (CISA KEV) · Business criticality. Each factor adds 25 points. P1 (24h) = score 75+. P2 (72h) = 50-74. P3 (next sprint) = under 50. Every finding ships with a step-by-step remediation playbook (owner, effort, evidence to collect) so security teams can execute, not just react.

CRITICAL (severity)
18
HIGH (severity)
2
MEDIUM (severity)
0
LOW (severity)
0

Severity Distribution

Critical
18
High
2
Medium
0
Low
0

Detector Hits

file_transfer_cve7
portal_tracker6
phi_in_url2
insider_email_exfil2
vendor_breach_intel2
vendor_missing_baa1

Blue-class Leak Pattern Coverage

1. Web tracker PHI leak — Google Analytics / Google Ads / Meta Pixel / Hotjar / FullStory / Adobe / LinkedIn / TikTok / Clarity / Mouseflow / CrazyEgg / Pendo / Segment / Amplitude / Mixpanel — mirrors the 4.7M Blue-class 2021-2024 leak pattern.
2. PHI in URL — MRN, SSN, DOB, member_id, patient_id, NPI, ICD-10 — prevents analytics pipelines and referrer leaks.
3. Insider email exfiltration — outbound to personal webmail with PHI signatures or bulk data attachments, including self-send pattern — mirrors the 2022 insider incident.
4. File transfer CVE exposure — MOVEit / Cleo / GoAnywhere / Accellion / WS_FTP with current CVEs — mirrors the 2023 MOVEit and 2024 Cleo incidents.
5. Third-party vendor breach — vendor inventory cross-checked against known recent breach intel (Conduent, Young Consulting, Cierant, NASCO, Change Healthcare) — mirrors the 2024 software-vendor ransomware and 2024-25 back-office vendor incidents.

HIPAA Controls Evidenced

164.50210
164.308(a)(1)7
164.308(a)(5)7
164.312(e)7
164.5044
164.5084
164.308(b)3
164.502(e)3
164.5142
164.308(a)(4)2
164.312(b)2
164.530(c)2
164.314(a)2

Self-Learning (ORACLE improves every round)

SCAN ROUNDS7
FIRST SCAN2026-04-24T20:55:58.756179+00:00
LAST SCAN2026-04-26T18:27:30.219207+00:00
ANALYST FEEDBACK0
TRUE POSITIVES0
FALSE POSITIVES0
ANALYST SUPPRESSIONS0
DETECTORHITSTPFPCONFIDENCE
file_transfer_cve49000.85
portal_tracker42000.85
phi_in_url14000.85
insider_email_exfil14000.85
vendor_breach_intel14000.85
vendor_missing_baa7000.85
Each analyst verdict raises detector confidence. Suppressed findings are remembered across runs. State persists on disk as oracle_portal_learning.json.

Threat Intelligence Feed

TRACKER SIGNATURES15
FILE-TRANSFER CVES TRACKED9
BREACHED VENDORS TRACKED5
ACTIVE RANSOMWARE GROUPS15
PHI QUERY PARAMS21
PERSONAL WEBMAIL DOMAINS14
Feed updates daily. CVE cross-check runs on every scan. Vendor intel expands as new breaches are disclosed.
RECOMMENDED PACKAGE

ENTERPRISE

$300K / year (floor, scales with user count and records)
Findings span all five Blue-class leak patterns with double digit criticals. Enterprise tier includes unlimited users, all five detectors fully enabled, daily threat-feed updates, 24x7 on-call, quarterly red-team of the portal, and an SLA-backed breach response retainer.
ROI benchmark — Anchored against the $16M OCR Anthem fine and $115M Anthem class action, a single prevented incident returns 50x to 400x the subscription cost.

All Findings (20)

FID
f6bfaaedcfe1054b
P1 · Fix in 24 hours CRITICAL file_transfer_cve DETAILS ▼
Progress MOVEit Transfer exposed to CVE-2023-34362
Patch the file transfer appliance within 24 hours, rotate credentials, and review egress logs for the backfill window of the CVE disclosure. Put the appliance b...
PRIORITY — P1 · Fix in 24 hours
RISK SCORE100/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Exploit In Wild+ Business Critical
FINDING FACTS
PRODUCTProgress MOVEit Transfer
VENDORProgress Software
HOSTmft01.regional-health.example
INSTALLED VERSION2022.0.2
CVECVE-2023-34362
CVSS9.8
AFFECTED BEFORE2022.1.5 / 2022.0.4 / 2021.1.4 / 2021.0.6
DESCRIPTIONSQL injection leading to RCE actively exploited by Clop ransomware group, source of the Blue Shield CA May 2023 breach
DETECTED AT2026-04-26T18:27:30.218487+00:00
ATTACHED TICKET
TICKET IDORACLE-F6BFAAEDCFE1054B
TYPEINC
CATEGORYVulnerability
PRIORITYP1
POLICYORACLE-FILE-TRANSFER-CVE-CRITICAL
HIPAA164.308(a)(1), 164.308(a)(5), 164.312(e)
REMEDIATION PLAYBOOK — Patch managed-file-transfer appliance CVE
OWNERSecurity + Infrastructure
ESTIMATED EFFORT24 hours (P1 emergency)
EVIDENCE TO COLLECTPatch confirmation + log review report + credential rotation ticket. Breach notification if applicable.
REGULATORY CITATIONCISA Known Exploited Vulnerabilities; HIPAA Breach Notification Rule 164.404.
  1. Take the vulnerable appliance OFFLINE immediately. Block ingress at the network firewall while patching.
  2. Apply the vendor patch. Versions: MOVEit 2024.0+, Cleo 5.8.0.21+, GoAnywhere 7.4.1+, Accellion FTA EOL (replace with Kiteworks), WS_FTP 8.8.4+.
  3. Audit access logs for the last 90 days against IOCs in the CISA advisory and vendor security bulletin. Look for: unexpected admin sessions, file enumeration, data exfiltration spikes, abnormal user-agent strings.
  4. Rotate ALL credentials that touched the appliance: service-account passwords, integration API tokens, encryption keys, TLS certs.
  5. If ANY IOC matched: trigger your breach disclosure workflow (HHS OCR within 60 days for >500 records; state AG per state law). Engage outside counsel.
RECOMMENDED ACTION
Patch the file transfer appliance within 24 hours, rotate credentials, and review egress logs for the backfill window of the CVE disclosure. Put the appliance behind a WAF with CVE specific virtual patches.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
4f444e7b8001388b
P1 · Fix in 24 hours CRITICAL file_transfer_cve DETAILS ▼
Progress MOVEit Transfer exposed to CVE-2023-35036
Patch the file transfer appliance within 24 hours, rotate credentials, and review egress logs for the backfill window of the CVE disclosure. Put the appliance b...
PRIORITY — P1 · Fix in 24 hours
RISK SCORE100/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Exploit In Wild+ Business Critical
FINDING FACTS
PRODUCTProgress MOVEit Transfer
VENDORProgress Software
HOSTmft01.regional-health.example
INSTALLED VERSION2022.0.2
CVECVE-2023-35036
CVSS9.1
AFFECTED BEFORENone
DESCRIPTIONAdditional SQLi in MOVEit Transfer
DETECTED AT2026-04-26T18:27:30.218527+00:00
ATTACHED TICKET
TICKET IDORACLE-4F444E7B8001388B
TYPEINC
CATEGORYVulnerability
PRIORITYP1
POLICYORACLE-FILE-TRANSFER-CVE-CRITICAL
HIPAA164.308(a)(1), 164.308(a)(5), 164.312(e)
REMEDIATION PLAYBOOK — Patch managed-file-transfer appliance CVE
OWNERSecurity + Infrastructure
ESTIMATED EFFORT24 hours (P1 emergency)
EVIDENCE TO COLLECTPatch confirmation + log review report + credential rotation ticket. Breach notification if applicable.
REGULATORY CITATIONCISA Known Exploited Vulnerabilities; HIPAA Breach Notification Rule 164.404.
  1. Take the vulnerable appliance OFFLINE immediately. Block ingress at the network firewall while patching.
  2. Apply the vendor patch. Versions: MOVEit 2024.0+, Cleo 5.8.0.21+, GoAnywhere 7.4.1+, Accellion FTA EOL (replace with Kiteworks), WS_FTP 8.8.4+.
  3. Audit access logs for the last 90 days against IOCs in the CISA advisory and vendor security bulletin. Look for: unexpected admin sessions, file enumeration, data exfiltration spikes, abnormal user-agent strings.
  4. Rotate ALL credentials that touched the appliance: service-account passwords, integration API tokens, encryption keys, TLS certs.
  5. If ANY IOC matched: trigger your breach disclosure workflow (HHS OCR within 60 days for >500 records; state AG per state law). Engage outside counsel.
RECOMMENDED ACTION
Patch the file transfer appliance within 24 hours, rotate credentials, and review egress logs for the backfill window of the CVE disclosure. Put the appliance behind a WAF with CVE specific virtual patches.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
d71661f12300db8a
P1 · Fix in 24 hours CRITICAL file_transfer_cve DETAILS ▼
Progress MOVEit Transfer exposed to CVE-2023-36934
Patch the file transfer appliance within 24 hours, rotate credentials, and review egress logs for the backfill window of the CVE disclosure. Put the appliance b...
PRIORITY — P1 · Fix in 24 hours
RISK SCORE100/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Exploit In Wild+ Business Critical
FINDING FACTS
PRODUCTProgress MOVEit Transfer
VENDORProgress Software
HOSTmft01.regional-health.example
INSTALLED VERSION2022.0.2
CVECVE-2023-36934
CVSS9.1
AFFECTED BEFORENone
DESCRIPTIONThird SQLi vector patched July 2023
DETECTED AT2026-04-26T18:27:30.218553+00:00
ATTACHED TICKET
TICKET IDORACLE-D71661F12300DB8A
TYPEINC
CATEGORYVulnerability
PRIORITYP1
POLICYORACLE-FILE-TRANSFER-CVE-CRITICAL
HIPAA164.308(a)(1), 164.308(a)(5), 164.312(e)
REMEDIATION PLAYBOOK — Patch managed-file-transfer appliance CVE
OWNERSecurity + Infrastructure
ESTIMATED EFFORT24 hours (P1 emergency)
EVIDENCE TO COLLECTPatch confirmation + log review report + credential rotation ticket. Breach notification if applicable.
REGULATORY CITATIONCISA Known Exploited Vulnerabilities; HIPAA Breach Notification Rule 164.404.
  1. Take the vulnerable appliance OFFLINE immediately. Block ingress at the network firewall while patching.
  2. Apply the vendor patch. Versions: MOVEit 2024.0+, Cleo 5.8.0.21+, GoAnywhere 7.4.1+, Accellion FTA EOL (replace with Kiteworks), WS_FTP 8.8.4+.
  3. Audit access logs for the last 90 days against IOCs in the CISA advisory and vendor security bulletin. Look for: unexpected admin sessions, file enumeration, data exfiltration spikes, abnormal user-agent strings.
  4. Rotate ALL credentials that touched the appliance: service-account passwords, integration API tokens, encryption keys, TLS certs.
  5. If ANY IOC matched: trigger your breach disclosure workflow (HHS OCR within 60 days for >500 records; state AG per state law). Engage outside counsel.
RECOMMENDED ACTION
Patch the file transfer appliance within 24 hours, rotate credentials, and review egress logs for the backfill window of the CVE disclosure. Put the appliance behind a WAF with CVE specific virtual patches.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
9bf360d936c152fa
P1 · Fix in 24 hours CRITICAL file_transfer_cve DETAILS ▼
Cleo VLTrader / Harmony / LexiCom exposed to CVE-2024-50623
Patch the file transfer appliance within 24 hours, rotate credentials, and review egress logs for the backfill window of the CVE disclosure. Put the appliance b...
PRIORITY — P1 · Fix in 24 hours
RISK SCORE100/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Exploit In Wild+ Business Critical
FINDING FACTS
PRODUCTCleo VLTrader / Harmony / LexiCom
VENDORCleo Communications
HOSTedi.regional-health.example
INSTALLED VERSION5.8.0.17
CVECVE-2024-50623
CVSS9.8
AFFECTED BEFORE5.8.0.21
DESCRIPTIONUnrestricted file upload leading to RCE, source of the BCBS Massachusetts Cierant breach December 2024
DETECTED AT2026-04-26T18:27:30.218590+00:00
ATTACHED TICKET
TICKET IDORACLE-9BF360D936C152FA
TYPEINC
CATEGORYVulnerability
PRIORITYP1
POLICYORACLE-FILE-TRANSFER-CVE-CRITICAL
HIPAA164.308(a)(1), 164.308(a)(5), 164.312(e)
REMEDIATION PLAYBOOK — Patch managed-file-transfer appliance CVE
OWNERSecurity + Infrastructure
ESTIMATED EFFORT24 hours (P1 emergency)
EVIDENCE TO COLLECTPatch confirmation + log review report + credential rotation ticket. Breach notification if applicable.
REGULATORY CITATIONCISA Known Exploited Vulnerabilities; HIPAA Breach Notification Rule 164.404.
  1. Take the vulnerable appliance OFFLINE immediately. Block ingress at the network firewall while patching.
  2. Apply the vendor patch. Versions: MOVEit 2024.0+, Cleo 5.8.0.21+, GoAnywhere 7.4.1+, Accellion FTA EOL (replace with Kiteworks), WS_FTP 8.8.4+.
  3. Audit access logs for the last 90 days against IOCs in the CISA advisory and vendor security bulletin. Look for: unexpected admin sessions, file enumeration, data exfiltration spikes, abnormal user-agent strings.
  4. Rotate ALL credentials that touched the appliance: service-account passwords, integration API tokens, encryption keys, TLS certs.
  5. If ANY IOC matched: trigger your breach disclosure workflow (HHS OCR within 60 days for >500 records; state AG per state law). Engage outside counsel.
RECOMMENDED ACTION
Patch the file transfer appliance within 24 hours, rotate credentials, and review egress logs for the backfill window of the CVE disclosure. Put the appliance behind a WAF with CVE specific virtual patches.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
d46df391ec693b0b
P1 · Fix in 24 hours CRITICAL file_transfer_cve DETAILS ▼
Cleo VLTrader / Harmony / LexiCom exposed to CVE-2024-55956
Patch the file transfer appliance within 24 hours, rotate credentials, and review egress logs for the backfill window of the CVE disclosure. Put the appliance b...
PRIORITY — P1 · Fix in 24 hours
RISK SCORE100/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Exploit In Wild+ Business Critical
FINDING FACTS
PRODUCTCleo VLTrader / Harmony / LexiCom
VENDORCleo Communications
HOSTedi.regional-health.example
INSTALLED VERSION5.8.0.17
CVECVE-2024-55956
CVSS9.8
AFFECTED BEFORE5.8.0.24
DESCRIPTIONPatch-bypass of CVE-2024-50623, actively exploited
DETECTED AT2026-04-26T18:27:30.218614+00:00
ATTACHED TICKET
TICKET IDORACLE-D46DF391EC693B0B
TYPEINC
CATEGORYVulnerability
PRIORITYP1
POLICYORACLE-FILE-TRANSFER-CVE-CRITICAL
HIPAA164.308(a)(1), 164.308(a)(5), 164.312(e)
REMEDIATION PLAYBOOK — Patch managed-file-transfer appliance CVE
OWNERSecurity + Infrastructure
ESTIMATED EFFORT24 hours (P1 emergency)
EVIDENCE TO COLLECTPatch confirmation + log review report + credential rotation ticket. Breach notification if applicable.
REGULATORY CITATIONCISA Known Exploited Vulnerabilities; HIPAA Breach Notification Rule 164.404.
  1. Take the vulnerable appliance OFFLINE immediately. Block ingress at the network firewall while patching.
  2. Apply the vendor patch. Versions: MOVEit 2024.0+, Cleo 5.8.0.21+, GoAnywhere 7.4.1+, Accellion FTA EOL (replace with Kiteworks), WS_FTP 8.8.4+.
  3. Audit access logs for the last 90 days against IOCs in the CISA advisory and vendor security bulletin. Look for: unexpected admin sessions, file enumeration, data exfiltration spikes, abnormal user-agent strings.
  4. Rotate ALL credentials that touched the appliance: service-account passwords, integration API tokens, encryption keys, TLS certs.
  5. If ANY IOC matched: trigger your breach disclosure workflow (HHS OCR within 60 days for >500 records; state AG per state law). Engage outside counsel.
RECOMMENDED ACTION
Patch the file transfer appliance within 24 hours, rotate credentials, and review egress logs for the backfill window of the CVE disclosure. Put the appliance behind a WAF with CVE specific virtual patches.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
aa232b7e5f82813a
P1 · Fix in 24 hours CRITICAL file_transfer_cve DETAILS ▼
Fortra GoAnywhere MFT exposed to CVE-2024-0204
Patch the file transfer appliance within 24 hours, rotate credentials, and review egress logs for the backfill window of the CVE disclosure. Put the appliance b...
PRIORITY — P1 · Fix in 24 hours
RISK SCORE100/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Exploit In Wild+ Business Critical
FINDING FACTS
PRODUCTFortra GoAnywhere MFT
VENDORFortra
HOSTga.regional-health.example
INSTALLED VERSION7.1.1
CVECVE-2024-0204
CVSS9.8
AFFECTED BEFORENone
DESCRIPTIONAuthentication bypass to admin
DETECTED AT2026-04-26T18:27:30.218663+00:00
ATTACHED TICKET
TICKET IDORACLE-AA232B7E5F82813A
TYPEINC
CATEGORYVulnerability
PRIORITYP1
POLICYORACLE-FILE-TRANSFER-CVE-CRITICAL
HIPAA164.308(a)(1), 164.308(a)(5), 164.312(e)
REMEDIATION PLAYBOOK — Patch managed-file-transfer appliance CVE
OWNERSecurity + Infrastructure
ESTIMATED EFFORT24 hours (P1 emergency)
EVIDENCE TO COLLECTPatch confirmation + log review report + credential rotation ticket. Breach notification if applicable.
REGULATORY CITATIONCISA Known Exploited Vulnerabilities; HIPAA Breach Notification Rule 164.404.
  1. Take the vulnerable appliance OFFLINE immediately. Block ingress at the network firewall while patching.
  2. Apply the vendor patch. Versions: MOVEit 2024.0+, Cleo 5.8.0.21+, GoAnywhere 7.4.1+, Accellion FTA EOL (replace with Kiteworks), WS_FTP 8.8.4+.
  3. Audit access logs for the last 90 days against IOCs in the CISA advisory and vendor security bulletin. Look for: unexpected admin sessions, file enumeration, data exfiltration spikes, abnormal user-agent strings.
  4. Rotate ALL credentials that touched the appliance: service-account passwords, integration API tokens, encryption keys, TLS certs.
  5. If ANY IOC matched: trigger your breach disclosure workflow (HHS OCR within 60 days for >500 records; state AG per state law). Engage outside counsel.
RECOMMENDED ACTION
Patch the file transfer appliance within 24 hours, rotate credentials, and review egress logs for the backfill window of the CVE disclosure. Put the appliance behind a WAF with CVE specific virtual patches.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
5811d80cbb52cb50
P1 · Fix in 24 hours CRITICAL phi_in_url DETAILS ▼
PHI identifier exposed in URL
Stop passing identifiers through URL query strings. Move identifiers into POST bodies or server side session lookups. URLs land in browser history, server logs,...
PRIORITY — P1 · Fix in 24 hours
RISK SCORE75/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Business Critical
FINDING FACTS
URLhttps://portal.regional-health.example/claim?mrn=MRN-884412&dob=04/17/1974
MATCHED PARAMSmrn, dob
PHI IN PATH
PHI IN QUERYmrn, dob
DETECTED AT2026-04-26T18:27:30.217608+00:00
ATTACHED TICKET
TICKET IDORACLE-5811D80CBB52CB50
TYPEINC
CATEGORYSecurity / Privacy
PRIORITYP1
POLICYORACLE-PORTAL-URL-PHI-BLOCK
HIPAA164.502, 164.514
REMEDIATION PLAYBOOK — Stop PHI from appearing in URL query strings
OWNERApplication Engineering + DevOps
ESTIMATED EFFORT2-4 weeks (web app change + log scrub)
EVIDENCE TO COLLECTBefore/after URL pattern samples + log scrub completion ticket.
REGULATORY CITATIONHIPAA 164.312(e)(1) Transmission Security; OCR breach reporting threshold 500 records.
  1. Pull every URL flagged by ORACLE with PHI patterns (SSN/MRN/DOB/NPI/ICD-10/credit card).
  2. Refactor web/mobile app: switch sensitive params from GET (URL) to POST (body). Critical for any redirect chain that touches CDN/web logs.
  3. Implement URL sanitization at the gateway layer: Cloudflare Logpush field-exclusion, NGINX log_format with masking, or AWS CloudFront field-level encryption.
  4. Purge web logs that contain historical PHI URLs (HIPAA breach if logged + retained beyond minimum-necessary).
  5. Add a CI lint rule blocking new code that places PHI patterns into query strings. Train developers.
RECOMMENDED ACTION
Stop passing identifiers through URL query strings. Move identifiers into POST bodies or server side session lookups. URLs land in browser history, server logs, referrer headers, and analytics pipelines.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
dfab2d36879a2546
P1 · Fix in 24 hours CRITICAL phi_in_url DETAILS ▼
PHI identifier exposed in URL
Stop passing identifiers through URL query strings. Move identifiers into POST bodies or server side session lookups. URLs land in browser history, server logs,...
PRIORITY — P1 · Fix in 24 hours
RISK SCORE75/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Business Critical
FINDING FACTS
URLhttps://portal.regional-health.example/auth?member_id=SUB-221199&ssn=123-45-6789
MATCHED PARAMSmember_id, ssn
PHI IN PATH
PHI IN QUERYssn
DETECTED AT2026-04-26T18:27:30.217772+00:00
ATTACHED TICKET
TICKET IDORACLE-DFAB2D36879A2546
TYPEINC
CATEGORYSecurity / Privacy
PRIORITYP1
POLICYORACLE-PORTAL-URL-PHI-BLOCK
HIPAA164.502, 164.514
REMEDIATION PLAYBOOK — Stop PHI from appearing in URL query strings
OWNERApplication Engineering + DevOps
ESTIMATED EFFORT2-4 weeks (web app change + log scrub)
EVIDENCE TO COLLECTBefore/after URL pattern samples + log scrub completion ticket.
REGULATORY CITATIONHIPAA 164.312(e)(1) Transmission Security; OCR breach reporting threshold 500 records.
  1. Pull every URL flagged by ORACLE with PHI patterns (SSN/MRN/DOB/NPI/ICD-10/credit card).
  2. Refactor web/mobile app: switch sensitive params from GET (URL) to POST (body). Critical for any redirect chain that touches CDN/web logs.
  3. Implement URL sanitization at the gateway layer: Cloudflare Logpush field-exclusion, NGINX log_format with masking, or AWS CloudFront field-level encryption.
  4. Purge web logs that contain historical PHI URLs (HIPAA breach if logged + retained beyond minimum-necessary).
  5. Add a CI lint rule blocking new code that places PHI patterns into query strings. Train developers.
RECOMMENDED ACTION
Stop passing identifiers through URL query strings. Move identifiers into POST bodies or server side session lookups. URLs land in browser history, server logs, referrer headers, and analytics pipelines.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
3e0451a902399e93
P1 · Fix in 24 hours CRITICAL portal_tracker DETAILS ▼
Tracker google_analytics present on analytics surface
Remove tracker from every page that renders or receives PHI. If retention is required, route through a HIPAA compliant analytics pipeline with BAA in place.
PRIORITY — P1 · Fix in 24 hours
RISK SCORE75/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Business Critical
FINDING FACTS
URLhttps://portal.regional-health.example/login
TRACKERgoogle_analytics
CATEGORYanalytics
MATCH TOKENgoogletagmanager.com
PHI PAGE CONTEXTTrue
DETECTED AT2026-04-26T18:27:30.216595+00:00
ATTACHED TICKET
TICKET IDORACLE-3E0451A902399E93
TYPEINC
CATEGORYSecurity / Privacy
PRIORITYP1
POLICYORACLE-PORTAL-TRACKER-BLOCK
HIPAA164.502, 164.504, 164.508
REMEDIATION PLAYBOOK — Remove third-party trackers from PHI pages
OWNERWeb/Marketing + Privacy
ESTIMATED EFFORT1-2 weeks
EVIDENCE TO COLLECTPre/post page-source diff + CSP header screenshot.
REGULATORY CITATIONOCR HIPAA bulletin Dec 2022 + 4.7M-record Blue-class settlements 2021-2024.
  1. Identify every page returning PHI (member portal, claims, EOBs, secure messaging) and list the trackers loading on each.
  2. Remove all third-party tracking scripts (Google Analytics 4, Meta Pixel, Hotjar, FullStory, Adobe, LinkedIn, TikTok, Clarity, Mouseflow, CrazyEgg, Pendo, Segment, Amplitude, Mixpanel) from those pages, working with Marketing/Web team.
  3. If analytics is required, sign a HIPAA-compliant BAA with the vendor first (note: Google does NOT sign BAA for standard GA4 - use Workspace Healthcare with limited scope).
  4. Configure a Content-Security-Policy header on PHI pages that blocks unauthorized analytics domains.
  5. Re-scan weekly with TITAN ORACLE to confirm no regression. Auto-ticket any new tracker via CONDUIT.
RECOMMENDED ACTION
Remove tracker from every page that renders or receives PHI. If retention is required, route through a HIPAA compliant analytics pipeline with BAA in place.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
4454be9075f7b2bd
P1 · Fix in 24 hours CRITICAL portal_tracker DETAILS ▼
Tracker meta_pixel present on advertising surface
Remove tracker from every page that renders or receives PHI. If retention is required, route through a HIPAA compliant analytics pipeline with BAA in place.
PRIORITY — P1 · Fix in 24 hours
RISK SCORE75/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Business Critical
FINDING FACTS
URLhttps://portal.regional-health.example/login
TRACKERmeta_pixel
CATEGORYadvertising
MATCH TOKENconnect.facebook.net
PHI PAGE CONTEXTTrue
DETECTED AT2026-04-26T18:27:30.216702+00:00
ATTACHED TICKET
TICKET IDORACLE-4454BE9075F7B2BD
TYPEINC
CATEGORYSecurity / Privacy
PRIORITYP1
POLICYORACLE-PORTAL-TRACKER-BLOCK
HIPAA164.502, 164.508
REMEDIATION PLAYBOOK — Remove third-party trackers from PHI pages
OWNERWeb/Marketing + Privacy
ESTIMATED EFFORT1-2 weeks
EVIDENCE TO COLLECTPre/post page-source diff + CSP header screenshot.
REGULATORY CITATIONOCR HIPAA bulletin Dec 2022 + 4.7M-record Blue-class settlements 2021-2024.
  1. Identify every page returning PHI (member portal, claims, EOBs, secure messaging) and list the trackers loading on each.
  2. Remove all third-party tracking scripts (Google Analytics 4, Meta Pixel, Hotjar, FullStory, Adobe, LinkedIn, TikTok, Clarity, Mouseflow, CrazyEgg, Pendo, Segment, Amplitude, Mixpanel) from those pages, working with Marketing/Web team.
  3. If analytics is required, sign a HIPAA-compliant BAA with the vendor first (note: Google does NOT sign BAA for standard GA4 - use Workspace Healthcare with limited scope).
  4. Configure a Content-Security-Policy header on PHI pages that blocks unauthorized analytics domains.
  5. Re-scan weekly with TITAN ORACLE to confirm no regression. Auto-ticket any new tracker via CONDUIT.
RECOMMENDED ACTION
Remove tracker from every page that renders or receives PHI. If retention is required, route through a HIPAA compliant analytics pipeline with BAA in place.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
224f695a69cfb1d7
P1 · Fix in 24 hours CRITICAL portal_tracker DETAILS ▼
Tracker hotjar present on session_replay surface
Remove tracker from every page that renders or receives PHI. If retention is required, route through a HIPAA compliant analytics pipeline with BAA in place.
PRIORITY — P1 · Fix in 24 hours
RISK SCORE75/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Business Critical
FINDING FACTS
URLhttps://portal.regional-health.example/login
TRACKERhotjar
CATEGORYsession_replay
MATCH TOKENstatic.hotjar.com
PHI PAGE CONTEXTTrue
DETECTED AT2026-04-26T18:27:30.216791+00:00
ATTACHED TICKET
TICKET IDORACLE-224F695A69CFB1D7
TYPEINC
CATEGORYSecurity / Privacy
PRIORITYP1
POLICYORACLE-PORTAL-TRACKER-BLOCK
HIPAA164.502, 164.504
REMEDIATION PLAYBOOK — Remove third-party trackers from PHI pages
OWNERWeb/Marketing + Privacy
ESTIMATED EFFORT1-2 weeks
EVIDENCE TO COLLECTPre/post page-source diff + CSP header screenshot.
REGULATORY CITATIONOCR HIPAA bulletin Dec 2022 + 4.7M-record Blue-class settlements 2021-2024.
  1. Identify every page returning PHI (member portal, claims, EOBs, secure messaging) and list the trackers loading on each.
  2. Remove all third-party tracking scripts (Google Analytics 4, Meta Pixel, Hotjar, FullStory, Adobe, LinkedIn, TikTok, Clarity, Mouseflow, CrazyEgg, Pendo, Segment, Amplitude, Mixpanel) from those pages, working with Marketing/Web team.
  3. If analytics is required, sign a HIPAA-compliant BAA with the vendor first (note: Google does NOT sign BAA for standard GA4 - use Workspace Healthcare with limited scope).
  4. Configure a Content-Security-Policy header on PHI pages that blocks unauthorized analytics domains.
  5. Re-scan weekly with TITAN ORACLE to confirm no regression. Auto-ticket any new tracker via CONDUIT.
RECOMMENDED ACTION
Remove tracker from every page that renders or receives PHI. If retention is required, route through a HIPAA compliant analytics pipeline with BAA in place.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
fb75969f1dd05faa
P1 · Fix in 24 hours CRITICAL portal_tracker DETAILS ▼
Tracker google_analytics present on analytics surface
Remove tracker from every page that renders or receives PHI. If retention is required, route through a HIPAA compliant analytics pipeline with BAA in place.
PRIORITY — P1 · Fix in 24 hours
RISK SCORE75/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Business Critical
FINDING FACTS
URLhttps://portal.regional-health.example/account
TRACKERgoogle_analytics
CATEGORYanalytics
MATCH TOKENgoogletagmanager.com
PHI PAGE CONTEXTTrue
DETECTED AT2026-04-26T18:27:30.216933+00:00
ATTACHED TICKET
TICKET IDORACLE-FB75969F1DD05FAA
TYPEINC
CATEGORYSecurity / Privacy
PRIORITYP1
POLICYORACLE-PORTAL-TRACKER-BLOCK
HIPAA164.502, 164.504, 164.508
REMEDIATION PLAYBOOK — Remove third-party trackers from PHI pages
OWNERWeb/Marketing + Privacy
ESTIMATED EFFORT1-2 weeks
EVIDENCE TO COLLECTPre/post page-source diff + CSP header screenshot.
REGULATORY CITATIONOCR HIPAA bulletin Dec 2022 + 4.7M-record Blue-class settlements 2021-2024.
  1. Identify every page returning PHI (member portal, claims, EOBs, secure messaging) and list the trackers loading on each.
  2. Remove all third-party tracking scripts (Google Analytics 4, Meta Pixel, Hotjar, FullStory, Adobe, LinkedIn, TikTok, Clarity, Mouseflow, CrazyEgg, Pendo, Segment, Amplitude, Mixpanel) from those pages, working with Marketing/Web team.
  3. If analytics is required, sign a HIPAA-compliant BAA with the vendor first (note: Google does NOT sign BAA for standard GA4 - use Workspace Healthcare with limited scope).
  4. Configure a Content-Security-Policy header on PHI pages that blocks unauthorized analytics domains.
  5. Re-scan weekly with TITAN ORACLE to confirm no regression. Auto-ticket any new tracker via CONDUIT.
RECOMMENDED ACTION
Remove tracker from every page that renders or receives PHI. If retention is required, route through a HIPAA compliant analytics pipeline with BAA in place.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
8e1324f03cb566af
P1 · Fix in 24 hours CRITICAL portal_tracker DETAILS ▼
Tracker meta_pixel present on advertising surface
Remove tracker from every page that renders or receives PHI. If retention is required, route through a HIPAA compliant analytics pipeline with BAA in place.
PRIORITY — P1 · Fix in 24 hours
RISK SCORE75/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Business Critical
FINDING FACTS
URLhttps://portal.regional-health.example/account
TRACKERmeta_pixel
CATEGORYadvertising
MATCH TOKENconnect.facebook.net
PHI PAGE CONTEXTTrue
DETECTED AT2026-04-26T18:27:30.217055+00:00
ATTACHED TICKET
TICKET IDORACLE-8E1324F03CB566AF
TYPEINC
CATEGORYSecurity / Privacy
PRIORITYP1
POLICYORACLE-PORTAL-TRACKER-BLOCK
HIPAA164.502, 164.508
REMEDIATION PLAYBOOK — Remove third-party trackers from PHI pages
OWNERWeb/Marketing + Privacy
ESTIMATED EFFORT1-2 weeks
EVIDENCE TO COLLECTPre/post page-source diff + CSP header screenshot.
REGULATORY CITATIONOCR HIPAA bulletin Dec 2022 + 4.7M-record Blue-class settlements 2021-2024.
  1. Identify every page returning PHI (member portal, claims, EOBs, secure messaging) and list the trackers loading on each.
  2. Remove all third-party tracking scripts (Google Analytics 4, Meta Pixel, Hotjar, FullStory, Adobe, LinkedIn, TikTok, Clarity, Mouseflow, CrazyEgg, Pendo, Segment, Amplitude, Mixpanel) from those pages, working with Marketing/Web team.
  3. If analytics is required, sign a HIPAA-compliant BAA with the vendor first (note: Google does NOT sign BAA for standard GA4 - use Workspace Healthcare with limited scope).
  4. Configure a Content-Security-Policy header on PHI pages that blocks unauthorized analytics domains.
  5. Re-scan weekly with TITAN ORACLE to confirm no regression. Auto-ticket any new tracker via CONDUIT.
RECOMMENDED ACTION
Remove tracker from every page that renders or receives PHI. If retention is required, route through a HIPAA compliant analytics pipeline with BAA in place.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
73295ed85da83294
P1 · Fix in 24 hours CRITICAL portal_tracker DETAILS ▼
Tracker hotjar present on session_replay surface
Remove tracker from every page that renders or receives PHI. If retention is required, route through a HIPAA compliant analytics pipeline with BAA in place.
PRIORITY — P1 · Fix in 24 hours
RISK SCORE75/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Business Critical
FINDING FACTS
URLhttps://portal.regional-health.example/account
TRACKERhotjar
CATEGORYsession_replay
MATCH TOKENstatic.hotjar.com
PHI PAGE CONTEXTTrue
DETECTED AT2026-04-26T18:27:30.217132+00:00
ATTACHED TICKET
TICKET IDORACLE-73295ED85DA83294
TYPEINC
CATEGORYSecurity / Privacy
PRIORITYP1
POLICYORACLE-PORTAL-TRACKER-BLOCK
HIPAA164.502, 164.504
REMEDIATION PLAYBOOK — Remove third-party trackers from PHI pages
OWNERWeb/Marketing + Privacy
ESTIMATED EFFORT1-2 weeks
EVIDENCE TO COLLECTPre/post page-source diff + CSP header screenshot.
REGULATORY CITATIONOCR HIPAA bulletin Dec 2022 + 4.7M-record Blue-class settlements 2021-2024.
  1. Identify every page returning PHI (member portal, claims, EOBs, secure messaging) and list the trackers loading on each.
  2. Remove all third-party tracking scripts (Google Analytics 4, Meta Pixel, Hotjar, FullStory, Adobe, LinkedIn, TikTok, Clarity, Mouseflow, CrazyEgg, Pendo, Segment, Amplitude, Mixpanel) from those pages, working with Marketing/Web team.
  3. If analytics is required, sign a HIPAA-compliant BAA with the vendor first (note: Google does NOT sign BAA for standard GA4 - use Workspace Healthcare with limited scope).
  4. Configure a Content-Security-Policy header on PHI pages that blocks unauthorized analytics domains.
  5. Re-scan weekly with TITAN ORACLE to confirm no regression. Auto-ticket any new tracker via CONDUIT.
RECOMMENDED ACTION
Remove tracker from every page that renders or receives PHI. If retention is required, route through a HIPAA compliant analytics pipeline with BAA in place.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
e67e261b63ee660c
P1 · Fix in 24 hours HIGH file_transfer_cve DETAILS ▼
Fortra GoAnywhere MFT exposed to CVE-2023-0669
Patch the file transfer appliance within 24 hours, rotate credentials, and review egress logs for the backfill window of the CVE disclosure. Put the appliance b...
PRIORITY — P1 · Fix in 24 hours
RISK SCORE100/100
RISK FACTORS+ Internet Facing+ Phi Exposure+ Exploit In Wild+ Business Critical
FINDING FACTS
PRODUCTFortra GoAnywhere MFT
VENDORFortra
HOSTga.regional-health.example
INSTALLED VERSION7.1.1
CVECVE-2023-0669
CVSS7.2
AFFECTED BEFORENone
DESCRIPTIONPre-auth RCE exploited by Clop for mass data theft
DETECTED AT2026-04-26T18:27:30.218641+00:00
ATTACHED TICKET
TICKET IDORACLE-E67E261B63EE660C
TYPEINC
CATEGORYVulnerability
PRIORITYP1
POLICYORACLE-FILE-TRANSFER-CVE-HIGH
HIPAA164.308(a)(1), 164.308(a)(5), 164.312(e)
REMEDIATION PLAYBOOK — Patch managed-file-transfer appliance CVE
OWNERSecurity + Infrastructure
ESTIMATED EFFORT24 hours (P1 emergency)
EVIDENCE TO COLLECTPatch confirmation + log review report + credential rotation ticket. Breach notification if applicable.
REGULATORY CITATIONCISA Known Exploited Vulnerabilities; HIPAA Breach Notification Rule 164.404.
  1. Take the vulnerable appliance OFFLINE immediately. Block ingress at the network firewall while patching.
  2. Apply the vendor patch. Versions: MOVEit 2024.0+, Cleo 5.8.0.21+, GoAnywhere 7.4.1+, Accellion FTA EOL (replace with Kiteworks), WS_FTP 8.8.4+.
  3. Audit access logs for the last 90 days against IOCs in the CISA advisory and vendor security bulletin. Look for: unexpected admin sessions, file enumeration, data exfiltration spikes, abnormal user-agent strings.
  4. Rotate ALL credentials that touched the appliance: service-account passwords, integration API tokens, encryption keys, TLS certs.
  5. If ANY IOC matched: trigger your breach disclosure workflow (HHS OCR within 60 days for >500 records; state AG per state law). Engage outside counsel.
RECOMMENDED ACTION
Patch the file transfer appliance within 24 hours, rotate credentials, and review egress logs for the backfill window of the CVE disclosure. Put the appliance behind a WAF with CVE specific virtual patches.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
100a8edb801b3bf5
P2 · Fix in 72 hours CRITICAL insider_email_exfil DETAILS ▼
Outbound email to personal webmail (gmail.com)
Quarantine the message, notify the privacy officer, and open a HIPAA sanctions case under 164.530(e). Block personal webmail domains at the secure email gateway...
PRIORITY — P2 · Fix in 72 hours
RISK SCORE50/100
RISK FACTORS+ Phi Exposure+ Business Critical
FINDING FACTS
FROM[email protected]
TO[email protected]
TO DOMAINgmail.com
SUBJECTmember roster backup
ATTACHMENTSmember-roster-Q2.xlsx
SIZE (BYTES)4194304
PHI SIGNATURES
RISK FACTORShas_attachment, attachment_over_1mb, bulk_data_file_type, self_send_to_personal_account
DETECTED AT2026-04-26T18:27:30.218147+00:00
ATTACHED TICKET
TICKET IDORACLE-100A8EDB801B3BF5
TYPEINC
CATEGORYInsider Threat
PRIORITYP2
POLICYORACLE-INSIDER-EXFIL-BLOCK
HIPAA164.308(a)(4), 164.312(b), 164.502, 164.530(c)
REMEDIATION PLAYBOOK — Block PHI exfiltration via personal email
OWNERSecurity + HR + IT
ESTIMATED EFFORT3-5 days (DLP rule + investigation)
EVIDENCE TO COLLECTDLP rule export + quarantine log + completed user-investigation ticket.
REGULATORY CITATIONHIPAA 164.308(a)(3)(ii)(B) Workforce Sanctions; HIPAA 164.312(b) Audit Controls.
  1. Create a Microsoft 365 / Google Workspace DLP rule: outbound email to personal-domain receivers (gmail.com, yahoo.com, outlook.com, hotmail.com, icloud.com, aol.com, etc.) containing PHI patterns or bulk attachments (CSV/XLS/ZIP) is blocked + quarantined for 7 days.
  2. Notify the user via auto-reply: 'Message contained PHI and was held. Contact privacy@yourco for review.'
  3. Audit the flagged user account for the last 90 days: similar attempts, after-hours access, large downloads.
  4. If a pattern of intentional exfiltration is detected, escalate to HR + legal under your AUP. Most incidents are accidental and resolved with training.
  5. Update Acceptable Use Policy to clarify PHI may not leave corporate email, ever. Get every employee acknowledgment.
RECOMMENDED ACTION
Quarantine the message, notify the privacy officer, and open a HIPAA sanctions case under 164.530(e). Block personal webmail domains at the secure email gateway for employees with PHI access.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
204a4af4a53eae60
P2 · Fix in 72 hours CRITICAL insider_email_exfil DETAILS ▼
Outbound email to personal webmail (yahoo.com)
Quarantine the message, notify the privacy officer, and open a HIPAA sanctions case under 164.530(e). Block personal webmail domains at the secure email gateway...
PRIORITY — P2 · Fix in 72 hours
RISK SCORE50/100
RISK FACTORS+ Phi Exposure+ Business Critical
FINDING FACTS
FROM[email protected]
TO[email protected]
TO DOMAINyahoo.com
SUBJECTclaims overflow
ATTACHMENTSclaims-export.csv
SIZE (BYTES)812000
PHI SIGNATURESssn, mrn, dob
RISK FACTORShas_attachment, bulk_data_file_type, phi_signatures_present, self_send_to_personal_account
DETECTED AT2026-04-26T18:27:30.218392+00:00
ATTACHED TICKET
TICKET IDORACLE-204A4AF4A53EAE60
TYPEINC
CATEGORYInsider Threat
PRIORITYP2
POLICYORACLE-INSIDER-EXFIL-BLOCK
HIPAA164.308(a)(4), 164.312(b), 164.502, 164.530(c)
REMEDIATION PLAYBOOK — Block PHI exfiltration via personal email
OWNERSecurity + HR + IT
ESTIMATED EFFORT3-5 days (DLP rule + investigation)
EVIDENCE TO COLLECTDLP rule export + quarantine log + completed user-investigation ticket.
REGULATORY CITATIONHIPAA 164.308(a)(3)(ii)(B) Workforce Sanctions; HIPAA 164.312(b) Audit Controls.
  1. Create a Microsoft 365 / Google Workspace DLP rule: outbound email to personal-domain receivers (gmail.com, yahoo.com, outlook.com, hotmail.com, icloud.com, aol.com, etc.) containing PHI patterns or bulk attachments (CSV/XLS/ZIP) is blocked + quarantined for 7 days.
  2. Notify the user via auto-reply: 'Message contained PHI and was held. Contact privacy@yourco for review.'
  3. Audit the flagged user account for the last 90 days: similar attempts, after-hours access, large downloads.
  4. If a pattern of intentional exfiltration is detected, escalate to HR + legal under your AUP. Most incidents are accidental and resolved with training.
  5. Update Acceptable Use Policy to clarify PHI may not leave corporate email, ever. Get every employee acknowledgment.
RECOMMENDED ACTION
Quarantine the message, notify the privacy officer, and open a HIPAA sanctions case under 164.530(e). Block personal webmail domains at the secure email gateway for employees with PHI access.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
18ca2ea4b6edd206
P2 · Fix in 72 hours CRITICAL vendor_breach_intel DETAILS ▼
Vendor match against recent breach intel: Conduent Business Services
Treat this vendor as compromised until they produce a clean forensic report. Rotate any shared secrets, pull recent exchange logs, and issue member notification...
PRIORITY — P2 · Fix in 72 hours
RISK SCORE50/100
RISK FACTORS+ Phi Exposure+ Business Critical
FINDING FACTS
VENDORConduent Business Services
BREACH WINDOW2024-10-21 to 2025-01-13
RANSOMWARE GROUPNone
US REACH25000000
BAA ON FILETrue
SERVICESprint, mail, PHI
DETECTED AT2026-04-26T18:27:30.218699+00:00
ATTACHED TICKET
TICKET IDORACLE-18CA2EA4B6EDD206
TYPEINC
CATEGORYVendor / Third Party
PRIORITYP2
POLICYORACLE-VENDOR-BREACH-INTEL-MATCH
HIPAA164.308(b), 164.314(a), 164.502(e)
REMEDIATION PLAYBOOK — Re-evaluate vendor in active OCR breach list
OWNERPrivacy + Procurement + Security
ESTIMATED EFFORT1-2 weeks (BAA review + attestation)
EVIDENCE TO COLLECTBAA amendment + vendor attestation + updated vendor risk score.
REGULATORY CITATIONHIPAA 164.502(e) Business Associate Contracts; OCR enforcement actions on vendor PHI exposures.
  1. Confirm whether the breached vendor is in your supply chain. Cross-reference against your BAA inventory.
  2. Request the vendor's incident report + a fresh attestation describing remediation and monitoring controls put in place.
  3. Review the existing BAA: ensure the breach-notification clause meets HIPAA timing requirements and your contract right-to-audit terms allow validation.
  4. Tighten the data-share contract: minimum-necessary access, encryption-at-rest required, key separation, no offshore processing without explicit consent.
  5. Add the vendor to your annual security review calendar. Don't wait for the next incident.
RECOMMENDED ACTION
Treat this vendor as compromised until they produce a clean forensic report. Rotate any shared secrets, pull recent exchange logs, and issue member notifications if PHI transited the vendor in the breach window.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
e7fd012c788cc09a
P2 · Fix in 72 hours CRITICAL vendor_breach_intel DETAILS ▼
Vendor match against recent breach intel: Young Consulting / Connexure
Treat this vendor as compromised until they produce a clean forensic report. Rotate any shared secrets, pull recent exchange logs, and issue member notification...
PRIORITY — P2 · Fix in 72 hours
RISK SCORE50/100
RISK FACTORS+ Phi Exposure+ Business Critical
FINDING FACTS
VENDORYoung Consulting / Connexure
BREACH WINDOW2024-04-10 to 2024-04-13
RANSOMWARE GROUPBlackSuit
US REACH954177
BAA ON FILETrue
SERVICESstop loss software
DETECTED AT2026-04-26T18:27:30.218731+00:00
ATTACHED TICKET
TICKET IDORACLE-E7FD012C788CC09A
TYPEINC
CATEGORYVendor / Third Party
PRIORITYP2
POLICYORACLE-VENDOR-BREACH-INTEL-MATCH
HIPAA164.308(b), 164.314(a), 164.502(e)
REMEDIATION PLAYBOOK — Re-evaluate vendor in active OCR breach list
OWNERPrivacy + Procurement + Security
ESTIMATED EFFORT1-2 weeks (BAA review + attestation)
EVIDENCE TO COLLECTBAA amendment + vendor attestation + updated vendor risk score.
REGULATORY CITATIONHIPAA 164.502(e) Business Associate Contracts; OCR enforcement actions on vendor PHI exposures.
  1. Confirm whether the breached vendor is in your supply chain. Cross-reference against your BAA inventory.
  2. Request the vendor's incident report + a fresh attestation describing remediation and monitoring controls put in place.
  3. Review the existing BAA: ensure the breach-notification clause meets HIPAA timing requirements and your contract right-to-audit terms allow validation.
  4. Tighten the data-share contract: minimum-necessary access, encryption-at-rest required, key separation, no offshore processing without explicit consent.
  5. Add the vendor to your annual security review calendar. Don't wait for the next incident.
RECOMMENDED ACTION
Treat this vendor as compromised until they produce a clean forensic report. Rotate any shared secrets, pull recent exchange logs, and issue member notifications if PHI transited the vendor in the breach window.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
FID
066b59644bf8958e
P3 · Fix in next sprint (2 weeks) HIGH vendor_missing_baa DETAILS ▼
Vendor missing BAA: New Analytics Startup
Execute a Business Associate Agreement before any further PHI exchange. If the vendor refuses, stop the data flow within 30 days.
PRIORITY — P3 · Fix in next sprint (2 weeks)
RISK SCORE25/100
RISK FACTORS+ Business Critical
FINDING FACTS
VENDORNew Analytics Startup
SERVICESclaims, PHI
DETECTED AT2026-04-26T18:27:30.218762+00:00
ATTACHED TICKET
TICKET IDORACLE-066B59644BF8958E
TYPECHG
CATEGORYVendor / Third Party
PRIORITYP3
POLICYORACLE-VENDOR-MISSING-BAA
HIPAA164.308(b), 164.502(e)
RECOMMENDED ACTION
Execute a Business Associate Agreement before any further PHI exchange. If the vendor refuses, stop the data flow within 30 days.
RISK STATUS: OPEN — NO EXCEPTION RECORDED
TITAN AI · ORACLE Portal + Vendor Risk Pack · Generated 2026-04-26T18:27:30.228621+00:00