WASHINGTONAccidentalHealthcareFinancial ServicesGovernmentHealthcareMisdeliveryPublishing ErrorCustomer Data InvolvedHealth (basic)Identity (basic)Government IDFinancial accountHighResolved

Washington State Department of Social and Health Services

bd_47214703c40a680c · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Feb 11, 2014

To disclose

—

Affected

3,104

Confidence

97%

Full breach record for Washington State Department of Social and Health Services →5 incidents on file

WA State Department of Social & Health Services reported to HHS on 2014-02-11 a mailing error (coded as 'Other, Unauthorized Access/Disclosure') affecting 3,104 individuals. Breached information was on Paper/Films. A coding error in an internal database caused mail to be sent to incorrect client addresses. PHI exposed may have included names, addresses, client IDs, dates of birth, SSNs, diagnoses, and financial information. OCR investigated, provided technical assistance on notification timeliness, and obtained assurances corrective actions were completed.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Feb 11, 2014

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed3,104 affectedView incident

Name: Washington State Department of Social and Health Services
norm: washington state department of social and health
Industry: Insurance — Health

Name: Washington State Department of Social and Health Services
norm: washington state department of social and health
Industry: Insurance — Health
Industry: Healthcaresource defaultFinancial ServicesllmGovernmentllm

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 3,104nationwide
Data types: Health (basic)Identity (basic)Government IDFinancial account
HHS breach type: OtherUnauthorized access or disclosure
Where the data lived: Paper / films
Covered-entity type: Health plan
Attack vector: Unauthorized Access
Threat actor: Internal
Regulator citations: HHS OCR investigated; provided technical assistance on timeliness of notifications and incident reporting; obtained assurances that corrective actions were completed.

During the incident: Breach notification sent to HHS, affected individuals, and the media.
Substitute notice posted on CE website.
Independent evaluation of the data breach commissioned.
Quality Improvement Team established.
Changes made: Hired independent firm to evaluate data breach and identify/correct root causes.
Formed a Quality Improvement Team to increase oversight of production and ensure quality assurance processes are strictly followed.
Posted substitute notice on website.
Provided breach notification to HHS, affected individuals, and the media.
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 11, 2014
Raw hash: f244f0300af4cd693193bd5c2c24ad8289d5d7df445d783394e92b2bf5675c99

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.0 KB

Download View at source

Reporting entityWashington State Department of Social and Health Services

Victim entityWashington State Department of Social and Health Services

IncidentUnauthorized Access

Stated responseBreach notification sent to HHS, affected individuals, and the media.

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing