UTPhysicalHealthcareHealthcareTheftCustomer Data InvolvedIDENTITY_BASICHEALTH_BASICFINANCIAL_ACCOUNTLowResolved

Valley Mental Health

bd_189a9bad4af34a83 · schema v1 · pii pii-v1

Full breach record for Valley Mental Health →

On February 27, 2013, Valley Mental Health (Salt Lake area, UT) discovered that a desktop computer hard drive had been stolen from a common-area facility accessible to members. The drive contained PHI for approximately 700 individuals, including names, diagnostic and treatment information, financial records, media release forms, photographs, activity sign-up sheets, and resumes. The CE notified HHS, affected individuals, and media. OCR investigated and the CE implemented corrective actions: encrypting hard drives, securing PHI in locked offices, and posting member privacy reminders. OCR provided technical assistance on Security Rule obligations.

HIPAA clock✓ HHS notified8 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed700 affectedView incident

Source provenance

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 26, 2013
Raw hash: b514cc9b6851be30365ab6d9d787ffdc1cf355fde47a102d08fc8ad50fa92d91

Source filing

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.9 KB

Download View at source

Reporting entity

Name: Valley Mental Health
norm: valley mental health-gb
Industry: Health Care Services

Victim entity

Name: Valley Mental Health
norm: valley mental health-gb
Industry: Health Care Services
Industry: Healthcaresource default

Incident

Discovered: Feb 27, 2013
Materiality determined: —
Notification sent: —
Affected individuals: 700
Data types: IDENTITY_BASICHEALTH_BASICFINANCIAL_ACCOUNT
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: HHS OCR investigated; CE provided corrective actions and technical assistance regarding Security Rule obligations.

Compliance

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Feb 27, 2013
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Feb 27, 2013 → Notified: not extracted	—	regulatory submission	HHS notified

Extraction provenance

Status: No extraction artifact recorded for this disclosure.