ARAccidentalHealthcareRetail & ConsumerHealthcareMisconfigurationCustomer Data InvolvedHEALTH_BASICIDENTITY_BASICFINANCIAL_ACCOUNTMediumResolved

WALMART INC.

bd_116f37ed37121d13 · schema v1 · pii pii-v1

Full breach record for WALMART INC. →

Walmart Stores, Inc. (AR, Healthcare Provider) reported to HHS OCR on 2016-03-01 an Unauthorized Access/Disclosure affecting 4,800 individuals. A software change caused a technical error that made ePHI viewable on Walmart's online pharmacy account portal. Exposed data included names, addresses, phone numbers, email addresses, prescriptions, insurance information, treatment information, and last four digits of credit card numbers. Breached information located on Electronic Medical Record. Walmart notified affected individuals, offered identity theft protection, and implemented additional privacy and security measures.

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

bd_7a140bd37681a101Montana State AGfiled 2016-03-01Candidate

Source provenance

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Mar 1, 2016
Raw hash: 237a4f1ad4416f768358da8ac42526acc3af89fa8e0a19db0903a7c802a4f4ca

Source filing

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.9 KB

Download View at source

Reporting entity

Name: WALMART INC.
norm: walmart
Domain: walmart.com
Industry: Health Care Services

Victim entity

Name: WALMART INC.
norm: walmart
Domain: walmart.com
Industry: Health Care Services
Industry: Healthcaresource defaultRetail & Consumerllm

Incident

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 4,800
Data types: HEALTH_BASICIDENTITY_BASICFINANCIAL_ACCOUNT
Attack vector: Unauthorized Access
MITRE ATT&CK: T1213 Data from Information Repositories
Regulator citations: OCR obtained assurances from Walmart that it implemented the actions noted above.

Compliance

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Extraction provenance

Status: No extraction artifact recorded for this disclosure.