CALIFORNIAHackingHealthcareHealthcareBusiness Associate (HIPAA)Supply Chain (3P Vendor)Customer Data InvolvedDelayed DiscoveryIdentity (basic)Health (basic)Financial accountMediumResolved

West Hills Hospital & Medical Center

bd_20d912ccda740925 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 12, 2019

Filed

Aug 6, 2019

To disclose

8 weeks

Affected

10,650

Confidence

95%

Full breach record for West Hills Hospital & Medical Center →

West Hills Hospital & Medical Center (CA) reported to HHS on 2019-08-06 a Hacking/IT Incident affecting 10,650 individuals. Business associate United WestLabs, Inc. notified the CE on June 12, 2019 that its subcontractor, American Medical Collection Agency, suffered unauthorized server access between August 1, 2018 and March 30, 2019. Exposed ePHI included names, addresses, medical account numbers, dates of service, amounts paid, referring doctors' codes, and disposition codes. The CE notified HHS, individuals, and media, and ceased sending collection accounts to the subcontractor. OCR reviewed BA agreements and confirmed corrective actions.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jun 12, 2019 → Notified Aug 6, 201955d ✓ HHS report on time8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 315 days

discovery → filing · 8 weeks / 55 days

Aug 1, 2018

Begins

Jun 12, 2019

Discovered

Aug 6, 2019

Filed

vs. sector median

2 wks faster

Part of Retrieval-Masters Creditors Bureau, Inc supply-chain incident (2019) — a supply-chain cascade affecting multiple organizations.View cascade →

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed10,650 affectedView incident

Name: West Hills Hospital & Medical Center
norm: west hills hospital medical center
Industry: Health Care Services

Name: West Hills Hospital & Medical Center
norm: west hills hospital medical center
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Jun 12, 2019
Breach occurred: Aug 1, 2018 – Mar 30, 2019
Undetected for: 315 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 6, 2019
Affected individuals: 10,650nationwide
Data types: Identity (basic)Health (basic)Financial account
HHS breach type: Hacking / IT incident
Where the data lived: Network server
Covered-entity type: Healthcare providerBusiness associate involved
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Regulator citations: OCR obtained documentation of applicable BA agreements.OCR obtained assurances that the CE implemented corrective action steps.
Third party: via American Medical Collection Agency

During the incident: CE provided breach notification to HHS, affected individuals, and the media.
CE ceased sending collection accounts to American Medical Collection Agency following the breach.
Changes made: Ceased sending collection accounts to the subcontractor.
Implemented corrective action steps confirmed by OCR.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: HHS report on time · 55dHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jun 12, 2019
→ Notified: Aug 6, 2019
55d 60 days HHS report on time
HIPAA
Discovered: Jun 12, 2019
→ Notified: Aug 6, 2019
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jun 12, 2019 → Notified: Aug 6, 2019	55d	60 days	HHS report on time
HIPAA	Discovered: Jun 12, 2019 → Notified: Aug 6, 2019	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Aug 6, 2019
Raw hash: 10141f9d0ee71425ed83a49496111b4cb5ccca8d6804b626ff5cf448709b9cc8

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.9 KB

Download View at source

Reporting entityWest Hills Hospital & Medical Center

Victim entityWest Hills Hospital & Medical Center

Incidentdiscovered Jun 12, 2019

Stated responseCE provided breach notification to HHS, affected individuals, and the media.

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing