COLORADOMisuseHealthcareHealthcarePrivilege AbuseCustomer Data InvolvedDelayed DiscoveryPHIHealth (basic)Identity (basic)MediumResolved

MEMORIAL HEALTH SYSTEM

bd_14ac3b92e79e577d · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 12, 2011

Filed

Jul 15, 2011

To disclose

3 days

Affected

2,330

Confidence

66%

Full breach record for MEMORIAL HEALTH SYSTEM →7 incidents on file

Memorial Health Systems reported to HHS on 2011-07-15 an Unauthorized Access/Disclosure affecting 2,330 individuals. A former nurse impermissibly accessed medical records between 2003 and May 2011 via the EHR system. Information located on Desktop Computer, Electronic Medical Record, Laptop, Network Server.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time3 days discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 3114 days

discovery → filing · 3 days

Jan 1, 2003

Begins

Jul 12, 2011

Discovered

Jul 15, 2011

Filed

vs. sector median

9 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,330 affectedView incident

Name: MEMORIAL HEALTH SYSTEM
norm: memorial health system
Industry: Health Care Services

Name: MEMORIAL HEALTH SYSTEM
norm: memorial health system
Industry: Healthcaresource default

Discovered: Jul 12, 2011
Breach occurred: Jan 1, 2003 – May 31, 2011
Undetected for: 3,114 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2,330nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Desktop computerElectronic medical recordLaptopNetwork server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Provided breach notification to HHSOCR investigation
Initial access: insider_action

During the incident: Terminated the former CSOHC nurse’s access to the EHR
Replaced the EHR
Developed and implemented several new Privacy and Security Rule policies and procedures
Conducted institution-wide HIPAA training
Implemented stricter audit controls
Implemented an information system activity review mechanism
Changes made: Developed and implemented several new Privacy and Security Rule policies and procedures
Conducted institution-wide HIPAA training
Implemented stricter audit controls
Implemented an information system activity review mechanism
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 3 days(3 days from discovery to filing)
Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jul 12, 2011
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Jul 12, 2011
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jul 12, 2011 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Jul 12, 2011 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jul 15, 2011
Raw hash: 984fdb789de664b4a17077aa0a2781dea36941c4884aacd97553e93999795522

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.2 KB

Download View at source

Reporting entityMEMORIAL HEALTH SYSTEM

Victim entityMEMORIAL HEALTH SYSTEM

Incidentdiscovered Jul 12, 2011

Stated responseTerminated the former CSOHC nurse’s access to the EHR

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing