MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedDelayed DiscoveryPIIPHIIdentity (basic)Health (basic)LowResolved

Cabell Huntington Hospital, Inc.

bd_122e169285be5f3c · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 25, 2019

Filed

Nov 24, 2021

To disclose

33 months

Affected

1state residents only

Linked

3 filings

Confidence

64%

Full breach record for Cabell Huntington Hospital, Inc. →

Huntington Hospital notified patients that an employee improperly accessed electronic medical records between October 2018 and February 2019. The incident involved PHI and PII. The employee was terminated, reported to law enforcement, and charged with a HIPAA violation. Patients were offered one year of Experian IdentityWorks. Notification was delayed until November 2021 per law enforcement instructions.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 147 days

discovery → filing · 33 months / 1003 days

Oct 1, 2018

Begins

Feb 25, 2019

Discovered

Nov 24, 2021

Filed

vs. sector median

+131 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Washington State AGbd_0180eda71ae0f8c92021-11-24Verified
HHS OCRbd_b4d807eabf357e7e2021-11-24Verified

Name: Cabell Huntington Hospital, Inc.
norm: cabell huntington hospital

Name: Cabell Huntington Hospital, Inc.
norm: cabell huntington hospital
Industry: Healthcarellm

Discovered: Feb 25, 2019
Breach occurred: Oct 1, 2018 – Feb 25, 2019
Undetected for: 147 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 24, 2021
Affected individuals: 1state-resident count only
Data types: PIIPHIIdentity (basic)Health (basic)
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Reported the matter to law enforcementFormer employee charged with a criminal HIPAA violation by the federal government
Initial access: insider_action

During the incident: Terminated the employee involved in the unauthorized access
Deactivated his access to our electronic medical record systems
Reported the matter to law enforcement
Cooperated fully with the law enforcement investigation
Provided employee training and targeted re-training of front-line staff
Reviewed and revised policies and procedures governing audits
Changes made: Implementing additional security tools to monitor access to our medical record applications
Office of Corporate Compliance conducts audits of medical record access
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 months(1003 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Washington State AGNov 24 · first

HHS OCRNov 24 · first

Montana State AGNov 24 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/OCP/Consumer-Notification-Letter-103.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 24, 2021
Raw hash: 42ebb1d2118357596771e3d216b0ca3b3fe54fca6024530938f2e08e9a66be2b

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityCabell Huntington Hospital, Inc.

Victim entityCabell Huntington Hospital, Inc.

Incidentdiscovered Feb 25, 2019

Stated responseTerminated the employee involved in the unauthorized access

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov