UTAHAccidentalHealthcareHealthcareDisposal ErrorCustomer Data InvolvedPHIHealth (basic)Identity (basic)Financial accountMediumResolved

Rocky Mountain Women's Health Center, Inc.

bd_0376a765630d927f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Dec 4, 2017

Filed

Jan 25, 2018

To disclose

7 weeks

Affected

1,123

Confidence

66%

Full breach record for Rocky Mountain Women's Health Center, Inc. →

Rocky Mountain Women's Health Center, Inc. reported to HHS on 2018-01-25 an Improper Disposal affecting 1123 individuals. Breached information located on Paper/Films. Documents containing patient PHI were accidentally left in vacated office space used by a business associate.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time7 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 857 days

discovery → filing · 7 weeks / 52 days

Jul 31, 2015

Begins

Dec 4, 2017

Discovered

Jan 25, 2018

Filed

vs. sector median

4 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,123 affectedView incident

Name: Rocky Mountain Women's Health Center, Inc.
norm: rocky mountain women s health center
Industry: Health Care Services

Name: Rocky Mountain Women's Health Center, Inc.
norm: rocky mountain women s health center
Industry: Healthcaresource default

Discovered: Dec 4, 2017
Breach occurred: Jul 31, 2015
Undetected for: 857 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,123nationwide
Data types: PHIHealth (basic)Identity (basic)Financial account
HHS breach type: Improper disposal
Where the data lived: Paper / films
Covered-entity type: Healthcare provider
Attack vector: Misconfiguration
MITRE ATT&CK: T1530 Data from Cloud Storage
Threat actor: Internal
Regulator citations: OCR obtained assurances that the CE implemented the corrective actions noted above

During the incident: Provided breach notification to HHS, affected individuals, and the media
Offered a free year of credit monitoring
Changes made: Revised procedures for vacating space to include a final walk through to check for remaining charts or other patient information
Trained staff with a focus on record retention and disposal
Developed a new record removal policy and procedure
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(52 days from discovery to filing)
Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Dec 4, 2017
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Dec 4, 2017
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Dec 4, 2017 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Dec 4, 2017 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jan 25, 2018
Raw hash: ee6c49cc986d6ba1f0886601b0c69d5cbd8663a5b0ca21c4e8fe46b68e042b02

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.2 KB

Download View at source

Reporting entityRocky Mountain Women's Health Center, Inc.

Victim entityRocky Mountain Women's Health Center, Inc.

Incidentdiscovered Dec 4, 2017

Stated responseProvided breach notification to HHS, affected individuals, and the media

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing