AccidentalHealthcareHealthcareMisdeliveryEmployee Data InvolvedPHIHealth (basic)Identity (basic)LowResolved

Western State Hospital

bd_370871de062c877f · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 20, 2017

Filed

Nov 15, 2017

To disclose

8 weeks

Affected

515state residents only

Confidence

70%

Full breach record for Western State Hospital →

Western State Hospital (WA) reported on Nov 15, 2017, that on Sep 20, 2017, a staff member inadvertently emailed PHI to an incorrect private email address. 515 Washington residents affected. Data included name, DOB, diagnosis, and medical record numbers. Incident reported same day; recipient deleted data. No ransomware or hacking involved.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 56 days

Sep 20, 2017

Begins

Sep 20, 2017

Discovered

Nov 15, 2017

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed515 affectedView incident

Name: Western State Hospital
norm: western state hospital

Name: Western State Hospital
norm: western state hospital
Industry: Healthcarellm

Discovered: Sep 20, 2017
Breach occurred: Sep 20, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 515state-resident count only
Data types: PHIHealth (basic)Identity (basic)
Data elements: NameMedical information
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle 0dexposure 0d
WA-stated discovery: Found while ongoingContained same day
Attack vector: Misconfiguration
MITRE ATT&CK: T1535 Unused/Unsupported Cloud Storage
Threat actor: Internal
Initial access: insider_action

During the incident: Required the staff member involved to receive further training and close supervision while handling confidential information
Implemented new procedures to further restrict access to patient information maintained by the hospital
Changes made: Implemented new procedures to further restrict access to patient information maintained by the hospital
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9750.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 15, 2017
Raw hash: 7a49cee91b05a40c0f70c7bff49e1ce32d93449f31d6e830f961601702385ed9

Reporting entityWestern State Hospital

Victim entityWestern State Hospital

Incidentdiscovered Sep 20, 2017

Stated responseRequired the staff member involved to receive further training and close supervision while handling confidential information

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com