FLORIDAMisuseHealthcareHealthcarePrivilege AbuseCustomer Data InvolvedData ExfiltratedPHIHealth (basic)Identity (basic)Government IDCriticalResolved

MEMORIAL HEALTH SYSTEM

bd_0d72abb1d6112dee · schema v1 · pii pii-v1

Severity

Critical

Financial impact

$5.50M

Discovered

—

Filed

Apr 13, 2012

To disclose

—

Affected

115,143

Linked

3 filings

Confidence

67%

Full breach record for MEMORIAL HEALTH SYSTEM →7 incidents on file

Memorial Healthcare System reported to HHS on 2012-04-13 a breach affecting 115,143 individuals. The breach involved the impermissible access and disclosure of protected health information (PHI) by employees and affiliated physician office staff using valid login credentials. Affected data included names, dates of birth, and social security numbers. The incident occurred between April 2011 and April 2012. MHS settled with HHS for $5.5 million and agreed to a corrective action plan.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline

Apr 1, 2011

Begins

Apr 13, 2012

Filed

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

New Hampshire State AGbd_6f5e9d17e45bf80e2012-04-12 · +1dVerified
Massachusetts State AGbd_06d72be731e557132012-04-17 · +4dVerified

Name: MEMORIAL HEALTH SYSTEM
norm: memorial health system
Industry: Insurance — Health

Name: MEMORIAL HEALTH SYSTEM
norm: memorial health system
Industry: Insurance — Health
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Breach occurred: Apr 1, 2011 – Apr 1, 2012
Materiality determined: —
Notification sent: —
Affected individuals: 115,143nationwide
Data types: PHIHealth (basic)Identity (basic)Government ID
HHS breach type: Other
Where the data lived: Other
Covered-entity type: Health plan
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Reported to the HHS Office for Civil Rights (OCR)Paid a $5.5 million settlement to HHS
Initial access: valid_credentials

During the incident: Paid the U.S. Department of Health and Human Services (HHS) $5.5 million to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules
Agreed to implement a robust corrective action plan
Changes made: Implement a robust corrective action plan
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

New Hampshire State AGApr 12 · first

HHS OCR+1d · this page

Massachusetts State AG+5d

Pattern: first filing Apr 12 (NH), last Apr 17 (MA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 13, 2012
Raw hash: f7cd879dae20d4365d743453465eff4e77f148ab03f27d4166204b6879ac9727

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html3.1 KB

Download View at source

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityMEMORIAL HEALTH SYSTEM

Victim entityMEMORIAL HEALTH SYSTEM

IncidentInsider

Stated responsePaid the U.S. Department of Health and Human Services (HHS) $5.5 million to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy and Security Rules

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing