MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)MediumContained

Florida Hospital

bd_15afb66cf61f18d8 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 15, 2011

Filed

Oct 13, 2011

To disclose

8 weeks

Affected

4state residents only

Linked

3 filings

Confidence

67%

Full breach record for Florida Hospital →5 incidents on file

Florida Hospital notified NH AG that on Aug 15, 2011, three employees accessed patient medical records (names, DOB, SSN, insurance) outside their job duties to identify MV accident victims for an attorney referral. 4 NH residents affected. Employees terminated, law enforcement notified, credit monitoring offered.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 59 days

Aug 15, 2011

Discovered

Oct 13, 2011

Filed

vs. sector median

4 wks faster

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_f33dae4c39b38b182011-10-13Verified
Massachusetts State AGbd_651f28f6f1cfa7742011-10-25 · +12dVerified

Name: BAKER & HOSTETLER LLP
norm: baker hostetler

Name: Florida Hospital
norm: florida hospital
Industry: Healthcarellm

Discovered: Aug 15, 2011
Materiality determined: —
Notification sent: Oct 13, 2011
Affected individuals: 4state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birthMedical information
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: InternalSecondary
Regulator citations: Notified law enforcement
Initial access: insider_action

During the incident: Terminated the involved employees
Developing mechanisms to lock down access of employees to only areas of the medical record required to do their job
Regular auditing of employee access to records
Enhancing their policies and procedures for employee access to medical records
Notified law enforcement
Offering them one year of free credit monitoring and credit protection services through Kroll Fraud Solutions
Changes made: Developing mechanisms to lock down access of employees to only areas of the medical record required to do their job
Regular auditing of employee access to records
Enhancing their policies and procedures for employee access to medical records
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCROct 13 · first

New Hampshire State AGOct 13 · first · this page

Massachusetts State AG+12d

Pattern: first filing Oct 13 (FL), last Oct 25 (MA) — a 12-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/florida-hospital-20111013.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 13, 2011
Raw hash: 7c698d6b0b0c7899f2400be8c5de0554f52a1a54c01ce65b1b1f235f2979cc39

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityBAKER & HOSTETLER LLP

Victim entityFlorida Hospital

Incidentdiscovered Aug 15, 2011

Stated responseTerminated the involved employees

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov