TEXASAccidentalHealthcareHealthcareDisposal ErrorTheftBusiness Associate (HIPAA)Customer Data InvolvedHealth (basic)Identity (basic)LowResolved

Digital Archive Management

bd_301d154a5a421189 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 26, 2012

Filed

Nov 21, 2012

To disclose

17 weeks

Affected

501

Confidence

96%

Full breach record for Digital Archive Management →2 incidents on file

Digital Archive Management (BA for El Centro Regional Medical Center, TX) reported to HHS on 2012-11-21 an Improper Disposal and Theft breach affecting 501 individuals. Breached information located on Network Server and Paper/Films (radiology film jackets and reports). The BA abandoned hard-copy radiology jackets and reports at a locked CE facility and failed to digitize/destroy records per the BAA; missing films were later found in an abandoned Nevada facility by the FBI. PHI included names, dates of birth, diagnoses, and conditions.

J jump to incidentP pin to compareR raw source

HIPAA clock✗ HHS report late17 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 17 weeks / 118 days

Jul 26, 2012

Begins

Jul 26, 2012

Discovered

Nov 21, 2012

Filed

vs. sector median

+4 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed501 affectedView incident

Name: Digital Archive Management
norm: digital archive management
Industry: Business Associate

Name: Digital Archive Management
norm: digital archive management
Industry: Business Associate
Industry: Healthcaresource default

Discovered: Jul 26, 2012
Breach occurred: Jul 26, 2012
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 501nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: Improper disposalTheft
Where the data lived: Network serverPaper / films
Covered-entity type: Business associate
Attack vector: Misconfiguration
Threat actor: Partner
Regulator citations: HHS OCR reviewed CE policies and procedures, risk analysis, risk management plan, and incident report; OCR verified proper BA agreement in place
Third party: via Digital Archive Management
Initial access: insider_action

During the incident: CE recovered abandoned jackets and radiology reports from locked El Centro facility
CE provided breach notification to HHS, affected individuals, and the media
FBI located missing radiology films and hard copy documents in abandoned commercial facility in Nevada
CE sanctioned certain employees
CE reviewed and updated its HIPAA policies and procedures
CE implemented security measures to reduce risks and vulnerabilities to PHI and ePHI
Changes made: Updated HIPAA policies and procedures
Implemented security measures to reduce risks and vulnerabilities to PHI and ePHI
Verified proper BA agreement with restrictions on BA's use/disclosure of PHI
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 17 weeks(118 days from discovery to filing)
Compliance flags: HHS report lateHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jul 26, 2012
→ Notified: not extracted
— 60 days HHS report late
HIPAA
Discovered: Jul 26, 2012
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jul 26, 2012 → Notified: not extracted	—	60 days	HHS report late
HIPAA	Discovered: Jul 26, 2012 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Nov 21, 2012
Raw hash: b6429648cb117334bd9e432c38b256a66e9c623f828221caeaa9b74175639d3a

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.4 KB

Download View at source

Reporting entityDigital Archive Management

Victim entityDigital Archive Management

Incidentdiscovered Jul 26, 2012

Stated responseCE recovered abandoned jackets and radiology reports from locked El Centro facility

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing