CALIFORNIAAccidentalHealthcareHealthcareMisconfigurationCustomer Data InvolvedDelayed DiscoveryHealth (basic)Identity (basic)HighResolved

ST. JOSEPH HEALTH SYSTEM

bd_0dece17688487427 · schema v1 · pii pii-v1

Severity

High

Financial impact

$2.14M

Discovered

Feb 14, 2012

Filed

Feb 15, 2012

To disclose

≤1 day

Affected

12,234

Linked

2 records

Confidence

96%

Full breach record for ST. JOSEPH HEALTH SYSTEM →3 incidents on file

St. Joseph Health System (CA) reported to HHS OCR on 2012-02-15 an Unauthorized Access/Disclosure affecting 12,234 individuals (HHS portal count; OCR investigation found 31,800 individuals actually exposed). ePHI stored on a network server was publicly accessible via internet search engines (e.g. Google) from Feb 1, 2011 to Feb 13, 2012, due to default file-sharing application settings left unconfigured. Data exposed included patient names, health statuses, diagnoses, and demographics. SJH settled with OCR for $2,140,500 and agreed to a corrective action plan.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Feb 14, 2012 → Notified Feb 15, 20121d ✓ HHS report on time≤1 day discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 378 days

discovery → filing · ≤1 day / 1 days

Feb 1, 2011

Begins

Feb 14, 2012

Discovered

Feb 15, 2012

Filed

vs. sector median

9 wks faster

This filing is one of 2 records about the same incident.View merged incident

Linked disclosures

Why this link?

Enforcement records (1)

HHS OCR enforcementbd_7c07ec9f136d4f6b2016-10-17 · +1706dVerified by operator

Name: ST. JOSEPH HEALTH SYSTEM
norm: st joseph health system
Domain: stjosephhealth.org
Industry: Health Care Services

Name: ST. JOSEPH HEALTH SYSTEM
norm: st joseph health system
Domain: stjosephhealth.org
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Feb 14, 2012
Breach occurred: Feb 1, 2011 – Feb 13, 2012
Undetected for: 378 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 15, 2012
Affected individuals: 12,234nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Network server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1530 Data from Cloud Storage
Regulator citations: HHS OCR investigation; settlement of $2,140,500 agreed; corrective action plan adopted including enterprise-wide risk analysis, risk management plan, policy revisions, and staff training

During the incident: Filed breach report with HHS OCR on 2012-02-15
Corrected default file-sharing application settings to restrict public access
Agreed to enterprise-wide risk analysis
Agreed to develop and implement a risk management plan
Agreed to revise policies and procedures
Agreed to train staff on revised policies and procedures
Changes made: Enterprise-wide risk analysis
Risk management plan implementation
Policy and procedure revision
Staff training on HIPAA Security Rule compliance
Source: Quoted from the filing itself, not independently verified.

Time to disclose: ≤1 day(1 days from discovery to filing)
Compliance flags: HHS report on time · 1dHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Feb 14, 2012
→ Notified: Feb 15, 2012
1d 60 days HHS report on time
HIPAA
Discovered: Feb 14, 2012
→ Notified: Feb 15, 2012
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Feb 14, 2012 → Notified: Feb 15, 2012	1d	60 days	HHS report on time
HIPAA	Discovered: Feb 14, 2012 → Notified: Feb 15, 2012	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 15, 2012
Raw hash: b83a69f32bfe0cf560a2d29380bfa95ab850e34a6b94707175ebabb467cbc35e

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html3.7 KB

Download View at source

Linked disclosures

Enforcement records (1)

Reporting entityST. JOSEPH HEALTH SYSTEM

Victim entityST. JOSEPH HEALTH SYSTEM

Incidentdiscovered Feb 14, 2012

Stated responseFiled breach report with HHS OCR on 2012-02-15

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing