CALIFORNIAMisuseHealthcareHealthcarePrivilege AbuseCustomer Data InvolvedPHIHealth (basic)MediumResolved

Consolidated Tribal Health Project, Inc.

bd_0b7f65e4684593d8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 31, 2014

Filed

Apr 28, 2015

To disclose

26 weeks

Affected

4,885

Confidence

67%

Full breach record for Consolidated Tribal Health Project, Inc. →2 incidents on file

Consolidated Tribal Health Project, Inc. reported to HHS on 2015-04-28 a Unauthorized Access/Disclosure affecting 4885 individuals. Breached information located on Desktop Computer, Electronic Medical Record, Email, Laptop, Network Server, Other Portable Electronic Device. An employee impermissibly accessed PHI prior to termination on 2014-10-31. No PHI was ultimately compromised.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Oct 31, 2014 → Notified Apr 28, 2015179d ✗ HHS report late26 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 26 weeks / 179 days

Oct 31, 2014

Begins

Oct 31, 2014

Discovered

Apr 28, 2015

Filed

vs. sector median

+13 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4,885 affectedView incident

Name: Consolidated Tribal Health Project, Inc.
norm: consolidated tribal health project
Industry: Health Care Services

Name: Consolidated Tribal Health Project, Inc.
norm: consolidated tribal health project
Industry: Healthcaresource default

Discovered: Oct 31, 2014
Breach occurred: Oct 31, 2014
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 28, 2015
Affected individuals: 4,885nationwide
Data types: PHIHealth (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Desktop computerElectronic medical recordEmailLaptopNetwork serverPortable electronic device
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Initial access: insider_action

During the incident: Reported this unauthorized access to local law enforcement
Retained third-party forensic experts to determine the nature and scope of this data security event
Notified the California Department of Public Health
Provided notification to the media and all affected individuals
Changes made: Revised its policies and procedures regarding the administrative, physical, and technical safeguards for protecting PHI
Re-trained its workforce members
Provided copies of these policies and procedures to all staff
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(179 days from discovery to filing)
Compliance flags: HHS report late · 179dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Oct 31, 2014
→ Notified: Apr 28, 2015
179d 60 days HHS report late
HIPAA
Discovered: Oct 31, 2014
→ Notified: Apr 28, 2015
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Oct 31, 2014 → Notified: Apr 28, 2015	179d	60 days	HHS report late
HIPAA	Discovered: Oct 31, 2014 → Notified: Apr 28, 2015	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 28, 2015
Raw hash: 0f055b47ea66b988dbf44b0ec84672926771ec0811dd791e6445476e933cba17

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.0 KB

Download View at source

Reporting entityConsolidated Tribal Health Project, Inc.

Victim entityConsolidated Tribal Health Project, Inc.

Incidentdiscovered Oct 31, 2014

Stated responseReported this unauthorized access to local law enforcement

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing