FLORIDAMisuseHealthcareHealthcareTheftPrivilege AbuseCustomer Data InvolvedData ExfiltratedHealth (basic)Identity (basic)Government IDHighResolved

Ladies First Choice, Inc.

bd_1010c468c3499437 · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 1, 2014

Filed

Apr 23, 2014

To disclose

16 weeks

Affected

2,365

Confidence

95%

Full breach record for Ladies First Choice, Inc. →

In January 2014, Ladies First Choice, Inc. (FL) discovered that a former employee took and misappropriated a confidential computer program containing ePHI of 2,365 individuals. The data included names, dates of birth, Social Security numbers, addresses, and identifying codes, stored on a laptop/computer program. The CE notified HHS, affected individuals, and the media. Corrective actions included staff retraining, policy review, new risk analysis, encryption, secure backup, and a civil action against the former employee. OCR obtained assurances of corrective action. Reported to HHS on 2014-04-23.

J jump to incidentP pin to compareR raw source

HIPAA clock✗ HHS report late16 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 16 weeks / 112 days

Jan 1, 2014

Discovered

Apr 23, 2014

Filed

vs. sector median

+3 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,365 affectedView incident

Name: Ladies First Choice, Inc.
norm: ladies first choice
Industry: Health Care Services

Name: Ladies First Choice, Inc.
norm: ladies first choice
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Jan 1, 2014
Materiality determined: —
Notification sent: —
Affected individuals: 2,365nationwide
Data types: Health (basic)Identity (basic)Government ID
HHS breach type: TheftUnauthorized access or disclosure
Where the data lived: Laptop
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical MediumT1078 Valid Accounts
Threat actor: Internal
Regulator citations: HHS OCR investigation; OCR obtained assurances of corrective action implementation
Initial access: insider_action

During the incident: Breach notification provided to HHS, affected individuals, and the media
Changes made: Identified vulnerabilities that contributed to the theft
Re-trained staff
Reviewed all safeguards policies and internal procedures including incident reporting policies
Performed a new risk analysis
Created new security features for computer systems including encryption
Implemented secure back up of PHI stored on hard drives
Filed civil action against former employee to enjoin use of misappropriated PHI
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 16 weeks(112 days from discovery to filing)
Compliance flags: HHS report lateHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jan 1, 2014
→ Notified: not extracted
— 60 days HHS report late
HIPAA
Discovered: Jan 1, 2014
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jan 1, 2014 → Notified: not extracted	—	60 days	HHS report late
HIPAA	Discovered: Jan 1, 2014 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 23, 2014
Raw hash: 4e5f042fef70fe9f7943fcb3d5d2078e1b95617e595ce4aa6e144e98d99db719

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.1 KB

Download View at source

Reporting entityLadies First Choice, Inc.

Victim entityLadies First Choice, Inc.

Incidentdiscovered Jan 1, 2014

Stated responseBreach notification provided to HHS, affected individuals, and the media

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing