CALIFORNIAMisuseHealthcareHealthcarePrivilege AbuseCustomer Data InvolvedPHIHealth (basic)Identity (basic)Government IDMediumResolved

White Blossom Care Center

bd_0b9e81a52ce2ea15 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 25, 2017

Filed

Jun 30, 2017

To disclose

5 weeks

Affected

800

Linked

2 filings

Confidence

69%

Full breach record for White Blossom Care Center →

White Blossom Care Center reported to HHS on 2017-06-30 an Unauthorized Access/Disclosure affecting 800 individuals. Former employees impermissibly accessed and copied residents' PHI including names, DOB, SSNs, and medical records. The entity engaged Mandiant, revised policies, retrained staff, and offered identity theft services.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered May 25, 2017 → Notified Jun 30, 201736d ✓ HHS report on time5 weeks discovery → filing

Incident timeline

discovery → filing · 5 weeks / 36 days

May 25, 2017

Discovered

Jun 30, 2017

Filed

vs. sector median

4 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_be768862234ee7d22017-06-30Verified

Name: White Blossom Care Center
norm: white blossom care center
Domain: whiteblossomcarecenter.com
Industry: Health Care Services

Name: White Blossom Care Center
norm: white blossom care center
Domain: whiteblossomcarecenter.com
Industry: Healthcaresource default

Discovered: May 25, 2017
Materiality determined: —
Notification sent: Jun 30, 2017
Affected individuals: 800nationwide
Data types: PHIHealth (basic)Identity (basic)Government ID
HHS breach type: Unauthorized access or disclosure
Where the data lived: Other
Covered-entity type: Healthcare provider
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: Internal
Regulator citations: Provided breach notification to HHSProvided OCR with additional documentation including its HIPAA Notice of Privacy Practices Policy
Initial access: insider_action

During the incident: Contacted the FBI and San Jose Police Department
Reported former employees to the California Department of Public Health Licensing Division
Worked with Mandiant, a digital forensics firm, to ensure internal safeguards were implemented to restrict patient’s PHI only to authorized employees
Revised its policies and procedures
Retrained workforce members
Offered identity theft provision services to affected individuals
Changes made: Implemented internal safeguards to restrict patient’s PHI only to authorized employees
Revised policies and procedures
Retrained workforce members
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: HHS report on time · 36dHHS notified
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: May 25, 2017
→ Notified: Jun 30, 2017
36d 60 days HHS report on time
HIPAA
Discovered: May 25, 2017
→ Notified: Jun 30, 2017
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: May 25, 2017 → Notified: Jun 30, 2017	36d	60 days	HHS report on time
HIPAA	Discovered: May 25, 2017 → Notified: Jun 30, 2017	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

California State AGJun 30 · first

HHS OCRJun 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jun 30, 2017
Raw hash: 1910165e2c8c60e4602f2cce84a1048e33d4d37b255735c5e54d4ea3d7c2e3ed

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.2 KB

Download View at source

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityWhite Blossom Care Center

Victim entityWhite Blossom Care Center

Incidentdiscovered May 25, 2017

Stated responseContacted the FBI and San Jose Police Department

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing