MisuseHealthcareHealthcareData MishandlingCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Elizabeth Hospice

bd_0d11391261f5bdd3 · schema v1 · pii pii-v1

Severity

Low

Discovered

Oct 21, 2022

Filed

Dec 14, 2022

To disclose

8 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

66%

Full breach record for Elizabeth Hospice →

The Elizabeth Hospice disclosed that a former employee forwarded business emails containing patient PHI (names, admission/discharge dates, account numbers, basic health info) to a personal email account. The incident was discovered on October 21, 2022. No SSNs or financial data were involved. The organization conducted an internal investigation.

J jump to incidentP pin to compareR raw source

California clockDiscovered Oct 21, 2022 → Notified Dec 14, 202254d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

discovery → filing · 8 weeks / 54 days

Oct 21, 2022

Discovered

Dec 14, 2022

Filed

vs. sector median

1 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Montana State AGbd_77ca191b5ef8a2f62022-12-14Verified
Delaware State AGbd_95e37044e8aba5542022-12-14Verified
HHS OCRbd_a71ea3eea00d7f582022-12-14Verified

Name: Elizabeth Hospice
norm: elizabeth hospice
Domain: elizabethhospice.org

Name: Elizabeth Hospice
norm: elizabeth hospice
Domain: elizabethhospice.org
Industry: Healthcarellm

Discovered: Oct 21, 2022
Materiality determined: —
Notification sent: Dec 14, 2022
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1114 Email Collection
Threat actor: Internal
Initial access: insider_action

During the incident: Initiated a response
Conducted an investigation to determine the extent of PHI transferred and identify potentially impacted individuals
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: CA 60-day OK · 54d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Oct 21, 2022
→ Notified: Dec 14, 2022
54d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Oct 21, 2022 → Notified: Dec 14, 2022	54d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 3 states

View merged incident ↗

Montana State AGDec 14 · first

Delaware State AGDec 14 · first

HHS OCRDec 14 · first

California State AGDec 14 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-560055
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 14, 2022
Raw hash: 359787ea0293aa956cd00fa017eb8a61204b0b03d3141a231789a599fc148899

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityElizabeth Hospice

Victim entityElizabeth Hospice

Incidentdiscovered Oct 21, 2022

Stated responseInitiated a response

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov