AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowResolved

ST. JOSEPH HEALTH SYSTEM

bd_24101abfc7bc8913 · schema v1 · pii pii-v1

Severity

Low

Discovered

Feb 18, 2014

Filed

Mar 3, 2014

To disclose

13 days

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for ST. JOSEPH HEALTH SYSTEM →4 incidents on file

St. Joseph Health disclosed an inadvertent email misdelivery on February 18, 2014, where an employee sent a Microsoft Excel file containing patient information (names, patient codes, referral/admission details) to an employee at Cain Brothers, an investment firm. The file was not encrypted. St. Joseph Health discovered the error the same evening, contacted the recipient, and confirmed the file was deleted. No SSNs or financial data were included. The organization retrained staff and reviewed policies.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 12 days

Feb 18, 2014

Begins

Feb 18, 2014

Discovered

Mar 3, 2014

Filed

vs. sector median

9 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_71f0cd64d801d2272014-03-05 · +2dVerified

Name: ST. JOSEPH HEALTH SYSTEM
norm: st joseph health system
Domain: stjosephhealth.org

Name: ST. JOSEPH HEALTH SYSTEM
norm: st joseph health system
Domain: stjosephhealth.org
Industry: Healthcarellm

Discovered: Feb 18, 2014
Breach occurred: Feb 18, 2014
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unknown
Threat actor: Internal
Third party: via Cain Brothers

During the incident: Immediately contacted the recipient of the file requesting that it be deleted and not used or disclosed
Received verbal and electronic confirmation from the recipient that the file was deleted and information was neither used nor disclosed
Secured the services of Kroll, a leader in risk mitigation and response related to the unintentional disclosure of confidential data
Changes made: Reviewed internal processes and policies to identify improvements to help prevent a similar incident from occurring in the future
Retrained staff in the appropriate use and disclosure of patient information and the applicable policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 days(13 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings · 2 states

View merged incident ↗

California State AGMar 3 · first · this page

HHS OCR+2d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-44318
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 3, 2014
Raw hash: bd5cccbf794a14946677dc535a81e46f5c05c4b61e888d978d3f645c19413c3e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityST. JOSEPH HEALTH SYSTEM

Victim entityST. JOSEPH HEALTH SYSTEM

Incidentdiscovered Feb 18, 2014

Stated responseImmediately contacted the recipient of the file requesting that it be deleted and not used or disclosed

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov