FLORIDAPhysicalHealthcareHealthcareLossCustomer Data InvolvedDelayed DiscoveryHealth (basic)Identity (basic)HighResolved

Jackson Health System

bd_36d29d1ed2d6db4a · schema v1 · pii pii-v1

Severity

High

Financial impact

$2.15M

Discovered

Jan 1, 2013

Filed

Aug 22, 2013

To disclose

33 weeks

Affected

1,471

Linked

2 filings

Confidence

93%

Full breach record for Jackson Health System →4 incidents on file

Jackson Health System (JHS), a nonprofit academic medical system in Miami, FL, reported to HHS OCR on 2013-08-22 a Loss of paper/films affecting 1,471 individuals. JHS's Health Information Management Department lost paper records containing patient PHI in December 2012 and January 2013. OCR ultimately imposed a civil money penalty of $2,154,000 for multiple HIPAA violations (2013–2016), including delayed breach notification, failure to conduct risk analyses, and failure to restrict workforce access to ePHI.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jan 1, 2013 → Notified Aug 22, 2013233d ✗ HHS report late33 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 31 days

discovery → filing · 33 weeks / 233 days

Dec 1, 2012

Begins

Jan 1, 2013

Discovered

Aug 22, 2013

Filed

vs. sector median

+21 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCR enforcementbd_08c996f6af10786f2019-10-23 · +2253dVerified by operator

Name: Jackson Health System
norm: jackson health system
Domain: jacksonhealth.org
Industry: Health Care Services

Name: Jackson Health System
norm: jackson health system
Domain: jacksonhealth.org
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Jan 1, 2013
Breach occurred: Dec 1, 2012 – Jan 31, 2013
Undetected for: 31 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 22, 2013
Affected individuals: 1,471nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: Loss
Where the data lived: Paper / films
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
Threat actor: Internal
Regulator citations: HHS OCR civil money penalty of $2,154,000 imposed for HIPAA Security and Breach Notification Rule violationsOCR Notice of Final Determination issued; JHS paid full civil money penaltyOCR investigation also covered additional incidents: unauthorized employee access (2015), employee selling PHI (2016)

During the incident: JHS waived right to hearing and did not contest OCR Notice of Proposed Determination
JHS paid full civil money penalty of $2,154,000
Changes made: Required to conduct enterprise-wide risk analysis
Required to manage identified risks to reasonable and appropriate level
Required to review information system activity records
Required to restrict workforce access to patient ePHI to minimum necessary
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 33 weeks(233 days from discovery to filing)
Compliance flags: HHS report late · 233dHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jan 1, 2013
→ Notified: Aug 22, 2013
233d 60 days HHS report late
HIPAA
Discovered: Jan 1, 2013
→ Notified: Aug 22, 2013
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jan 1, 2013 → Notified: Aug 22, 2013	233d	60 days	HHS report late
HIPAA	Discovered: Jan 1, 2013 → Notified: Aug 22, 2013	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRAug 22 · first · this page

HHS OCR enforcement+2253d

Pattern: first filing Aug 22 (FL), last Oct 23 — a 2253-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Aug 22, 2013
Raw hash: 02b6cc95fe75e897aeedcdd4c5a7818d30fb80bfc5c264b361c6587aae016dd5

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html3.8 KB

Download View at source

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityJackson Health System

Victim entityJackson Health System

Incidentdiscovered Jan 1, 2013

Stated responseJHS waived right to hearing and did not contest OCR Notice of Proposed Determination

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing