CALIFORNIAPhysicalHealthcareHealthcareTheftCustomer Data InvolvedPHIHealth (basic)Identity (basic)MediumContained

Stanford Health Care (SHC) and Stanford School of Medicine (SOM)

bd_4947a3a7572aca20 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jul 15, 2012

Filed

Aug 3, 2012

To disclose

19 days

Affected

2,641

Linked

2 filings

Confidence

65%

Stanford Health Care (SHC) and Stanford School of Medicine (SOM) reported to HHS on 2012-08-03 a Theft affecting 2641 individuals. Breached information located on Desktop Computer. A password-protected computer was stolen from a locked office containing ePHI of approximately 2,641 individuals, including clinical and demographic information. No evidence indicated ePHI was inappropriately accessed.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jul 15, 2012 → Notified Aug 3, 201219d ✓ HHS report on time19 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 19 days

Jul 15, 2012

Begins

Jul 15, 2012

Discovered

Aug 3, 2012

Filed

vs. sector median

6 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_c59d32af053767de2012-08-10 · +7dVerified

Name: Stanford Health Care (SHC) and Stanford School of Medicine (SOM)
norm: stanford health care stanford school of medicine
Industry: Health Care Services

Name: Stanford Health Care (SHC) and Stanford School of Medicine (SOM)
norm: stanford health care stanford school of medicine
Industry: Healthcaresource default

Discovered: Jul 15, 2012
Breach occurred: Jul 15, 2012 – Jul 16, 2012
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 3, 2012
Affected individuals: 2,641nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Theft
Where the data lived: Desktop computer
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: notification the media and HHS

During the incident: Contacted law enforcement
Notified the affected individuals
Offered identity protection services at no cost to the affected individuals
Established a toll-free call center to assist affected individuals with questions or concerns
Notification the media and HHS
Changes made: Implemented additional physical safeguards
Audited SCH desktops and laptops to ensure encryption
Issued security awareness reminders to workforce
Initiated plans to implement an improved risk management process
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 days(19 days from discovery to filing)
Compliance flags: HHS report on time · 19dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jul 15, 2012
→ Notified: Aug 3, 2012
19d 60 days HHS report on time
HIPAA
Discovered: Jul 15, 2012
→ Notified: Aug 3, 2012
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jul 15, 2012 → Notified: Aug 3, 2012	19d	60 days	HHS report on time
HIPAA	Discovered: Jul 15, 2012 → Notified: Aug 3, 2012	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRAug 3 · first · this page

California State AG+7d

Pattern: first filing Aug 3 (CA), last Aug 10 (CA) — a 7-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Aug 3, 2012
Raw hash: 370f1749737015b97e2d3879481fb1f9a5b332ed76727a071a0abce4b58feb29

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.2 KB

Download View at source

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityStanford Health Care (SHC) and Stanford School of Medicine (SOM)

Victim entityStanford Health Care (SHC) and Stanford School of Medicine (SOM)

Incidentdiscovered Jul 15, 2012

Stated responseContacted law enforcement

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing