CALIFORNIAAccidentalHealthcareHealthcareMisconfigurationCustomer Data InvolvedDelayed DiscoveryHealth (basic)Identity (basic)HighResolved

ST. JOSEPH HEALTH SYSTEM

bd_0dece17688487427 · schema v1 · pii pii-v1

Severity

High

Financial impact

$2.14M

Discovered

Feb 14, 2012

Filed

Feb 15, 2012

To disclose

≤1 day

Affected

12,234

Linked

2 filings

Confidence

96%

Full breach record for ST. JOSEPH HEALTH SYSTEM →4 incidents on file

St. Joseph Health System (CA) reported to HHS OCR on 2012-02-15 an Unauthorized Access/Disclosure affecting 12,234 individuals (HHS portal count; OCR investigation found 31,800 individuals actually exposed). ePHI stored on a network server was publicly accessible via internet search engines (e.g. Google) from Feb 1, 2011 to Feb 13, 2012, due to default file-sharing application settings left unconfigured. Data exposed included patient names, health statuses, diagnoses, and demographics. SJH settled with OCR for $2,140,500 and agreed to a corrective action plan.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Feb 14, 2012 → Notified Feb 15, 20121d ✓ HHS report on time≤1 day discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 378 days

discovery → filing · ≤1 day / 1 days

Feb 1, 2011

Begins

Feb 14, 2012

Discovered

Feb 15, 2012

Filed

vs. sector median

11 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCR enforcementbd_7c07ec9f136d4f6b2016-10-17 · +1706dVerified by operator

Name: ST. JOSEPH HEALTH SYSTEM
norm: st joseph health system
Domain: stjosephhealth.org
Industry: Health Care Services

Name: ST. JOSEPH HEALTH SYSTEM
norm: st joseph health system
Domain: stjosephhealth.org
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Feb 14, 2012
Breach occurred: Feb 1, 2011 – Feb 13, 2012
Undetected for: 378 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 15, 2012
Affected individuals: 12,234nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Network server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1530 Data from Cloud Storage
Regulator citations: HHS OCR investigation; settlement of $2,140,500 agreed; corrective action plan adopted including enterprise-wide risk analysis, risk management plan, policy revisions, and staff training

During the incident: Filed breach report with HHS OCR on 2012-02-15
Corrected default file-sharing application settings to restrict public access
Agreed to enterprise-wide risk analysis
Agreed to develop and implement a risk management plan
Agreed to revise policies and procedures
Agreed to train staff on revised policies and procedures
Changes made: Enterprise-wide risk analysis
Risk management plan implementation
Policy and procedure revision
Staff training on HIPAA Security Rule compliance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(1 days from discovery to filing)
Compliance flags: HHS report on time · 1dHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Feb 14, 2012
→ Notified: Feb 15, 2012
1d 60 days HHS report on time
HIPAA
Discovered: Feb 14, 2012
→ Notified: Feb 15, 2012
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Feb 14, 2012 → Notified: Feb 15, 2012	1d	60 days	HHS report on time
HIPAA	Discovered: Feb 14, 2012 → Notified: Feb 15, 2012	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRFeb 15 · first · this page

HHS OCR enforcement+1706d

Pattern: first filing Feb 15 (CA), last Oct 17 — a 1706-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 15, 2012
Raw hash: b83a69f32bfe0cf560a2d29380bfa95ab850e34a6b94707175ebabb467cbc35e

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html3.7 KB

Download View at source

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityST. JOSEPH HEALTH SYSTEM

Victim entityST. JOSEPH HEALTH SYSTEM

Incidentdiscovered Feb 14, 2012

Stated responseFiled breach report with HHS OCR on 2012-02-15

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing