MisuseHealthcareHealthcareData MishandlingCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)Government IDMediumContained

Family Health Centers of San Diego

bd_29e5ae363041c3fb · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

May 12, 2026

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for Family Health Centers of San Diego →

Family Health Centers of San Diego reported that a physician employee sent personal health information to their personal email address. The incident window is listed as December 15, 2021, to February 27, 2026. Affected data includes names, medical record numbers, contact info, dates of birth, and medical information. The physician was terminated, access revoked, and legal action initiated. Credit monitoring is offered.

J jump to incidentP pin to compareR raw source

California clockConsumers notified Apr 30, 2026 → AG copy submitted May 12, 202612d ✓ CA AG copy ≤15d

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

Incident timeline

Dec 15, 2021

Begins

May 12, 2026

Filed

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_70e38f986c1fccad2026-05-12Verified

Name: Family Health Centers of San Diego
norm: family health centers of san diego
Domain: fhcsd.org

Name: Family Health Centers of San Diego
norm: family health centers of san diego
Domain: fhcsd.org
Industry: Healthcarellm

Discovered: —
Breach occurred: Dec 15, 2021 – Feb 27, 2026
Materiality determined: —
Notification sent: Apr 30, 2026
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Government ID
Data elements: Date of birthMedical information
Attack vector: Insider
Threat actor: Internal
Regulator citations: Reporting the physician to the Medical Board of CaliforniaReporting the physician to the California Attorney General
Initial access: insider_action

During the incident: Shutting down the physician’s access to records
Terminating the physician’s employment with Family Health Centers of San Diego
Initiating legal action against the physician to ensure your information is destroyed
Reporting the physician to the Medical Board of California and the California Attorney General
Changes made: Implementing additional safeguards to help prevent this from happening again
Enrolling affected individuals in a major credit reporting agency for one year at no cost
Source: Quoted from the filing itself, not independently verified.

Compliance flags: CA AG copy ≤15d · 12d
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Consumers notified: Apr 30, 2026
→ AG copy submitted: May 12, 2026
12d 15 calendar days CA AG copy ≤15d

Statute	Window	Elapsed	Threshold	Status
California	Consumers notified: Apr 30, 2026 → AG copy submitted: May 12, 2026	12d	15 calendar days	CA AG copy ≤15d

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRMay 12 · first

California State AGMay 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-623313
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 12, 2026
Raw hash: fad178a4994d10617c3b530b6836b9e78df206b8abedcda608892a92669ca7ec

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityFamily Health Centers of San Diego

Victim entityFamily Health Centers of San Diego

IncidentInsider

Stated responseShutting down the physician’s access to records

ComplianceCA AG copy ≤15d

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov