OKLAHOMAMalwareHealthcareHealthcareRansomwareData ExfiltratedData EncryptedCustomer Data InvolvedPHIHealth (basic)Identity (basic)Government IDHighContained

Duncan Regional Hospital, Inc.

bd_379ce2137f1b8b8e · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Mar 4, 2022

To disclose

—

Affected

86,379

Linked

8 filings

Confidence

67%

Full breach record for Duncan Regional Hospital, Inc. →2 incidents on file

Duncan Regional Hospital, Incorporated reported to HHS on 2022-03-04 a Hacking/IT Incident affecting 86,379 individuals. Breached information located on Network Server. The incident involved a ransomware attack encrypting PHI including names, DOB, SSN, addresses, driver's license numbers, diagnoses, and treatment info. Response included credit monitoring, security awareness training, enterprise-wide password reset, and technical safeguards.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Mar 4, 2022

Filed

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (7) · sorted by filing gap

New Hampshire State AGbd_8e12f6dc142dcf3d2022-03-04Verified
Maine State AGbd_951471bd831a875b2022-03-04Verified
Indiana State AGbd_da7f54b2a4437b3e2022-03-04Verified
Montana State AGbd_e83433683660598a2022-03-04Verified

Show 3 more filings ↓up to 62d gap

Maine State AGbd_9cf8dc6e97bedca72022-03-03 · +1dVerified
Massachusetts State AGbd_0a4d100cea574cd72022-03-15 · +11dVerified
Illinois State AGbd_a382b9c075b77cac2022-01-01 · +62dCandidate

Name: Duncan Regional Hospital, Inc.
norm: duncan regional hospital
Industry: Health Care Services

Name: Duncan Regional Hospital, Inc.
norm: duncan regional hospital
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 86,379nationwide
Data types: PHIHealth (basic)Identity (basic)Government ID
HHS breach type: Hacking / IT incident
Where the data lived: Network server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified HHS

During the incident: Provided complimentary credit monitoring services to affected individuals
Added additional training on security awareness
Implemented an enterprise-wide password reset
Implemented additional technical safeguards to protect its network
Changes made: Added additional training on security awareness
Implemented an enterprise-wide password reset
Implemented additional technical safeguards to protect its network
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 8 filings · 7 states

View merged incident ↗

Illinois State AGJan 1 · first

Maine State AG+61d

New Hampshire State AG+62d

Maine State AG+62d

Indiana State AG+62d

Montana State AG+62d

HHS OCR+62d · this page

Massachusetts State AG+73d

Pattern: first filing Jan 1 (IL), last Mar 15 (MA) — a 73-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Mar 4, 2022
Raw hash: 7b9e7161f2868d9976e4abd04202b4aa53da9a6dc1faaa7a0b9878ce09cd0d0c

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.7 KB

Download View at source

Linked disclosures

Regulatory filings (7) · sorted by filing gap

Reporting entityDuncan Regional Hospital, Inc.

Victim entityDuncan Regional Hospital, Inc.

IncidentUnauthorized Access

Stated responseProvided complimentary credit monitoring services to affected individuals

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing