MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDPHIMediumActive

MEMORIAL HEALTH SYSTEM

bd_1453aa07e0fc43fd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 27, 2012

Filed

Jul 11, 2012

To disclose

11 weeks

Affected

29state residents only

Confidence

65%

Full breach record for MEMORIAL HEALTH SYSTEM →7 incidents on file

Memorial Healthcare System (MHS) notified the NH Attorney General that employees of affiliated physicians improperly accessed patient information via a web portal. Discovery began April 27, 2012. Data accessed included names, DOBs, and SSNs during 2011-2012. 29 NH residents affected. MHS contacted law enforcement, offered 1 year of credit monitoring, and enhanced auditing controls. Investigation ongoing.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 482 days

discovery → filing · 11 weeks / 75 days

Jan 1, 2011

Begins

Apr 27, 2012

Discovered

Jul 11, 2012

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed29 affectedView incident

Name: BAKER & HOSTETLER LLP
norm: baker hostetler

Name: MEMORIAL HEALTH SYSTEM
norm: memorial health system
Industry: Healthcarellm

Discovered: Apr 27, 2012
Breach occurred: Jan 1, 2011 – Dec 31, 2012
Undetected for: 482 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 11, 2012
Affected individuals: 29state-resident count only
Data types: Identity (basic)Government IDPHI
Data elements: Social Security numberDate of birth
Attack vector: Insider
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: Internal
Regulator citations: Notified New Hampshire Office of the Attorney GeneralLaw enforcement is still involved and MHS continues to cooperate with their investigation
Initial access: insider_action

During the incident: Contacted law enforcement
Began a comprehensive review of its patient information systems
Offering one year of free credit monitoring through Experian
Refine its privacy policies
Limit access by employees of affiliated physicians
Reinforce with all staff and affiliated physicians’ employees the importance of handling patient information carefully
Enhance its auditing controls by taking advantage of recent advances in technology
Changes made: Refine its privacy policies
Limit access by employees of affiliated physicians
Reinforce with all staff and affiliated physicians’ employees the importance of handling patient information carefully
Enhance its auditing controls by taking advantage of recent advances in technology
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 11 weeks(75 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/memorial-healthcare-20120711.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 11, 2012
Raw hash: 7dfd8ee6786ec62d1621d9492d845cee16c0d7fbc04f47227bc723aab8e3f575

Reporting entityBAKER & HOSTETLER LLP

Victim entityMEMORIAL HEALTH SYSTEM

Incidentdiscovered Apr 27, 2012

Stated responseContacted law enforcement

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov