DisclosureLens
MARYLANDHackingHealthcareHealthcareCustomer Data InvolvedHealth (basic)Identity (basic)Financial accountMedium

Serene Sedation

bd_24e19da63db15456 · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Mar 14, 2018

To disclose

—

Affected

5,207

Confidence

50%
Full breach record for Serene Sedation →

An unauthorized user accessed the computer network of a business associate (BA) which stored the financial records of Serene Sedation, LLC (CE). The server contained the protected health information (PHI) of approximately 5,207 individuals, including demographic and financial information. Following the breach, the CE discontinued storing financial records on its BA's networks, and increased its own security by adding encryption. OCR reviewed the CE’s risk analysis and BA agreements and obtained assurances that the CE took immediate steps to increase the security of ePHI by encrypting its computer hard drives, encrypting outgoing e-mails, and using a virtual private network (VPN). The CE provided breach notification to HHS, affected individuals, and the media.

HIPAA clock✓ HHS notified
⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Mar 14, 2018

Filed

—

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed5,207 affectedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.