AccidentalHealthcareHealthcareMisconfigurationData MishandlingCustomer Data InvolvedDelayed DiscoveryPHIIdentity (basic)Health (basic)LowResolved

Universal Care, Inc.

bd_0a6e40c5986753bb · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 28, 2016

Filed

Mar 3, 2017

To disclose

9 weeks

Affected

Not disclosed

Confidence

65%

Full breach record for Universal Care, Inc. →2 incidents on file

Brand New Day (DBA of Universal Care) experienced an unauthorized disclosure of protected health information (PHI) on December 22, 2016, discovered on December 28, 2016. A third-party vendor system error allowed a contracting provider to access member data including name, DOB, Medicare ID, address, and phone number. The vendor corrected the error within hours. Brand New Day reported the incident to the CA AG and HHS. Notification was delayed due to a law enforcement investigation. Affected members are offered 12 months of identity theft mitigation services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 6 days

discovery → filing · 9 weeks / 65 days

Dec 22, 2016

Begins

Dec 28, 2016

Discovered

Mar 3, 2017

Filed

vs. sector median

on median

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Universal Care, Inc.
norm: universal care

Name: Universal Care, Inc.
norm: universal care
Also named: Universal Caredba oflegal entity
Brand New Daydba oftrade name
Industry: Healthcarellm

Discovered: Dec 28, 2016
Breach occurred: Dec 22, 2016
Undetected for: 6 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIIdentity (basic)Health (basic)
Attack vector: Third-Party / Supply Chain
Threat actor: Partner
Regulator citations: Reported this breach to the California Office of the Attorney GeneralReported it to the United States Department of Health & Human Services
Third party: via third party vendor
Initial access: trusted_relationship

During the incident: Investigated the breach to determine how this unintentional error resulted in unauthorized access
Contacted the third party vendor the same day we became aware of the breach
Advised the vendor that someone without appropriate permission was able to access your information
Reported this breach to the California Office of the Attorney General
Reported it to the United States Department of Health & Human Services
Changes made: Vendor eliminated the error in their system within hours
Reviewed our existing policies and procedures
Conducting a self-audit of our procedures to identify any error that could result in this error occurring again
Changed our practices regarding access requiring monthly verification of each user
All of our employees will be contacted to remind them of the priorities of protecting health information and reporting any potential breaches immediately to the Compliance Officer
Offering 12 free months of identity theft and mitigation services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(65 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-66713
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 3, 2017
Raw hash: 397767afe2b6235df4d27d2468bca998e14b45ad99c9b63b31658447cae34e90

Reporting entityUniversal Care, Inc.

Victim entityUniversal Care, Inc.

Incidentdiscovered Dec 28, 2016

Stated responseInvestigated the breach to determine how this unintentional error resulted in unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov