CALIFORNIAAccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedPHIHealth (basic)Identity (basic)MediumResolved

RoxSan Pharmacy, Inc.

bd_30d19a4224be8b59 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 20, 2015

Filed

Mar 12, 2018

To disclose

38 months

Affected

1,049

Confidence

67%

Full breach record for RoxSan Pharmacy, Inc. →

RoxSan Pharmacy, Inc. reported to HHS on 2018-03-12 a Unauthorized Access/Disclosure affecting 1049 individuals. Breached information located on Email. An employee emailed a spreadsheet containing ePHI (patient, insurance, prescription info) to an attorney on January 20, 2015.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jan 20, 2015 → Notified Mar 12, 20181147d ✗ HHS report late38 months discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 38 months / 1147 days

Jan 20, 2015

Begins

Jan 20, 2015

Discovered

Mar 12, 2018

Filed

vs. sector median

+153 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,049 affectedView incident

Name: RoxSan Pharmacy, Inc.
norm: roxsan pharmacy
Industry: Health Care Services

Name: RoxSan Pharmacy, Inc.
norm: roxsan pharmacy
Industry: Healthcaresource default

Discovered: Jan 20, 2015
Breach occurred: Jan 20, 2015
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 12, 2018
Affected individuals: 1,049nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Email
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1566 Phishing
Threat actor: Internal

During the incident: The CE updated its policies and procedures addressing the use and disclosure of PHI, safeguarding PHI, de-identifying PHI, and employee sanctions for noncompliance with HIPAA
The employee responsible for the breach was sanctioned and counseled on how to better safeguard PHI to prevent future breach incidents
All employees of the CE were retrained on the updated policies and procedures
The CE provided notice to HHS, individual notification, and media notification
Changes made: Updated policies and procedures addressing the use and disclosure of PHI, safeguarding PHI, de-identifying PHI, and employee sanctions for noncompliance with HIPAA
Retrained all employees on the updated policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 months(1147 days from discovery to filing)
Compliance flags: HHS report late · 1147dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jan 20, 2015
→ Notified: Mar 12, 2018
1147d 60 days HHS report late
HIPAA
Discovered: Jan 20, 2015
→ Notified: Mar 12, 2018
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jan 20, 2015 → Notified: Mar 12, 2018	1147d	60 days	HHS report late
HIPAA	Discovered: Jan 20, 2015 → Notified: Mar 12, 2018	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Mar 12, 2018
Raw hash: 2226bf5bda1226515b77d8c77b523f226c2b9d6182bce4b800335112af178fb6

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.3 KB

Download View at source

Reporting entityRoxSan Pharmacy, Inc.

Victim entityRoxSan Pharmacy, Inc.

Incidentdiscovered Jan 20, 2015

Stated responseThe CE updated its policies and procedures addressing the use and disclosure of PHI, safeguarding PHI, de-identifying PHI, and employee sanctions for noncompliance with HIPAA

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing