HackingHealthcareHealthcareStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPHIHealth (basic)HighContained

Creative Hospice Care, Inc.

bd_00e75c0b6d220156 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 31, 2022

Filed

May 23, 2022

To disclose

8 weeks

Affected

1,798state residents only

Linked

2 filings

Confidence

62%

Full breach record for Creative Hospice Care, Inc. →2 incidents on file

Creative Hospice Care, Inc. d/b/a Homestead Hospice & Palliative Care notified South Carolina residents of unauthorized access to email accounts and lost laptops between April 2021 and March 2022. Potentially affected data included names, SSNs, DOBs, medical record numbers, and PHI. The company engaged forensic investigators and offered credit monitoring.

J jump to incidentP pin to compareR raw source

South Carolina clock✓ SC CRA notice due8 weeks discovery → filing

Incident timeline

undetected · 364 days

discovery → filing · 8 weeks / 53 days

Apr 1, 2021

Begins

Mar 31, 2022

Discovered

May 23, 2022

Filed

vs. sector median

5 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_0e15f3894cf758c92022-05-23Verified

Name: Creative Hospice Care, Inc.
norm: creative hospice care

Name: Creative Hospice Care, Inc.
norm: creative hospice care
Also named: Creative Hospice Care, Inc.dba oflegal entity
Homestead Hospice & Palliative Caredba oftrade name
Industry: Healthcarellm

Discovered: Mar 31, 2022
Breach occurred: Apr 1, 2021 – Mar 31, 2022
Undetected for: 364 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 24, 2022
Affected individuals: 1,798state-resident count only
Data types: Identity (basic)Government IDPHIHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Took steps to contain the issue
Began a detailed investigation with the assistance of outside cyber security firms
Contacted former workforce members to confirm that patient information contained on the laptops, if any, has not been misused or disclosed
Offering you a complimentary one-year membership in Experian® Identity WorksTM Credit 3B
Changes made: Reinforcing education with our staff on patient privacy
Implemented additional security measures to enhance our email security
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: SC CRA notice due
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

HHS OCRMay 23 · first

South Carolina State AGMay 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://consumer.sc.gov/sites/consumer/files/Documents/Business%20Resources%20Laws/Related%20Laws/Breaches/2022/CreativeHospiceCareInc..pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 23, 2022
Raw hash: f4ebac590747ff47c576aa4b248986a1af97e81a432190a51796eeb1d0aff138

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCreative Hospice Care, Inc.

Victim entityCreative Hospice Care, Inc.

Incidentdiscovered Mar 31, 2022

Stated responseTook steps to contain the issue

ComplianceSC CRA notice due

Extraction provenanceno artifact recorded

Source provenanceconsumer.sc.gov