OHIOAccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedIdentity (basic)Health (basic)MediumResolved

Fairfield Medical Center

bd_100232bb3a06b0a7 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 17, 2019

Filed

Aug 15, 2019

To disclose

29 days

Affected

1,182

Confidence

66%

Full breach record for Fairfield Medical Center →

Fairfield Medical Center reported to HHS on 2019-08-15 a Unauthorized Access/Disclosure affecting 1182 individuals. Breached information located on Paper/Films. On July 17, 2019, the CE forwarded mismatched member information to its business associate, causing members to receive mail containing another member’s name and location of service.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jul 17, 2019 → Notified Aug 15, 201929d ✓ HHS report on time29 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 29 days

Jul 17, 2019

Begins

Jul 17, 2019

Discovered

Aug 15, 2019

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,182 affectedView incident

Name: Fairfield Medical Center
norm: fairfield medical center
Industry: Health Care Services

Name: Fairfield Medical Center
norm: fairfield medical center
Industry: Healthcaresource default

Discovered: Jul 17, 2019
Breach occurred: Jul 17, 2019
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 15, 2019
Affected individuals: 1,182nationwide
Data types: Identity (basic)Health (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Paper / films
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1530 Data from Cloud Storage
Threat actor: Internal
Regulator citations: Notified HHSOCR obtained documented assurances that the CE implemented the corrective actions noted above

During the incident: Provided self-addressed stamp envelopes to facilitate the return of the incorrectly addressed letters
Implemented a procedure to ensure that documents will be correctly formatted and saved in a format which cannot be changed
Implemented quality measures to ensure information is correct
Completed execution of a renewal business associate agreement with its vendor
Provided breach notification to HHS, affected individuals, and the media
Changes made: Implemented a procedure to ensure that documents will be correctly formatted and saved in a format which cannot be changed
Implemented quality measures to ensure information is correct
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: HHS report on time · 29dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jul 17, 2019
→ Notified: Aug 15, 2019
29d 60 days HHS report on time
HIPAA
Discovered: Jul 17, 2019
→ Notified: Aug 15, 2019
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jul 17, 2019 → Notified: Aug 15, 2019	29d	60 days	HHS report on time
HIPAA	Discovered: Jul 17, 2019 → Notified: Aug 15, 2019	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Aug 15, 2019
Raw hash: 1b8f322a76c3193662cdc54ec3494d7b783c536fb03f4cea9da7545ea290d6f4

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.8 KB

Download View at source

Reporting entityFairfield Medical Center

Victim entityFairfield Medical Center

Incidentdiscovered Jul 17, 2019

Stated responseProvided self-addressed stamp envelopes to facilitate the return of the incorrectly addressed letters

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing