MisuseGovernmentHealthcareGovernmentData MishandlingEmployee Data InvolvedCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIHighContained

Washington State Health Care Authority

bd_263658b09207ad92 · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 16, 2015

Filed

Feb 9, 2016

To disclose

8 weeks

Affected

91,187state residents only

Confidence

70%

Full breach record for Washington State Health Care Authority →2 incidents on file

Washington State Health Care Authority notified the WA AG of an unauthorized disclosure of Apple Health (Medicaid) beneficiary data. Between Nov 2013 and Dec 2015, an employee emailed spreadsheets containing PHI, SSNs, and PII to another state employee. HCA discovered the incident on Dec 16, 2015. 91,187 beneficiaries were affected. HCA terminated the employee, investigated, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 761 days

discovery → filing · 8 weeks / 55 days

Nov 15, 2013

Begins

Dec 16, 2015

Discovered

Feb 9, 2016

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed91,187 affectedView incident

Name: Washington State Health Care Authority
norm: washington state health care authority
Domain: hca.wa.gov

Name: Washington State Health Care Authority
norm: washington state health care authority
Domain: hca.wa.gov
Industry: GovernmentllmHealthcarellm

Discovered: Dec 16, 2015
Breach occurred: Nov 15, 2013 – Dec 24, 2015
Undetected for: 761 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 9, 2016
Affected individuals: 91,187state-resident count only
Data types: Identity (basic)Government IDHealth (basic)PHI
Data elements: Medical informationDate of birthSocial Security numberName
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 500+dexposure 500+d
WA-stated discovery: Found while ongoing
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified the Washington State Attorney General pursuant to RCW 42.56.590Notifying the appropriate federal officials for further investigation and potential criminal review
Initial access: insider_action

During the incident: Investigating how the information was transferred and used
Taking possession of all information that was sent by the HCA employee and received by the other state employee
Conducting separate interviews with both employees to understand the circumstances surrounding the exchange of information
Terminating the employment of the HCA staff involved in the incident
Reminding all HCA employees as to the importance of protecting private health and personal information
Planning additional training for our staff to address this specific issue
Notifying the appropriate federal officials for further investigation and potential criminal review
Changes made: Offering complimentary one-year membership of Experian’s ProtectMyID Alert for adults
Offering complimentary one-year membership in Family Secure from Experian for parents or guardians of minors
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(55 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9610.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 9, 2016
Raw hash: 19560a3a31d9ce0905bc0d38283f11e4abccee4c3568adefd069da130d2d4b7f

Reporting entityWashington State Health Care Authority

Victim entityWashington State Health Care Authority

Incidentdiscovered Dec 16, 2015

Stated responseInvestigating how the information was transferred and used

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com