CALIFORNIAHackingHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedData ExfiltratedPHIHealth (basic)Identity (basic)Government IDFinancial accountCriticalResolved

PIH HEALTH, INC.

bd_4a28b4853227a5ed · schema v1 · pii pii-v1

Severity

Critical

Financial impact

$600K

Discovered

Jun 1, 2019

Filed

Jan 10, 2020

To disclose

32 weeks

Affected

199,548

Linked

7 filings

Confidence

66%

Full breach record for PIH HEALTH, INC. →5 incidents on file

PIH Health, Inc. reported to HHS OCR on 2020-01-10 a Hacking/IT Incident affecting 199,548 individuals. The breach involved a phishing attack in June 2019 that compromised employee email accounts, exposing unsecured ePHI including names, SSNs, and medical data. Location of breached info: Email.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jun 1, 2019 → Notified Jan 10, 2020223d ✗ HHS report late32 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 32 weeks / 223 days

Jun 1, 2019

Begins

Jun 1, 2019

Discovered

Jan 10, 2020

Filed

vs. sector median

+19 wks slower

This filing is one of 7 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (6) · sorted by filing gap

Massachusetts State AGbd_27d7777e802fa91b2020-01-10Verified
New Hampshire State AGbd_8571a8c5bf1cf1e82020-01-10Verified
California State AGbd_a21953b1532e9ead2020-01-10Verified
Indiana State AGbd_affe7d5b7013704d2020-01-10Verified

Show 2 more filings ↓up to 1930d gap

Illinois State AGbd_a91cc01f9afd40902020-01-01 · +9dCandidate
HHS OCR enforcementbd_86698e91d73c9fe22025-04-23 · +1930dVerified by operator

Name: PIH HEALTH, INC.
norm: pih health
Industry: Health Care Services

Name: PIH HEALTH, INC.
norm: pih health
Industry: Healthcaresource default

Discovered: Jun 1, 2019
Breach occurred: Jun 1, 2019 – Jun 30, 2019
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 10, 2020
Affected individuals: 199,548nationwide
Data types: PHIHealth (basic)Identity (basic)Government IDFinancial account
HHS breach type: Hacking / IT incident
Where the data lived: Email
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: ExternalFinancial
Regulator citations: Notified HHS OCRSettlement agreement with HHS OCR
Initial access: phishing_link

During the incident: Agreed to implement a corrective action plan monitored by OCR for two years
Paid a $600,000 settlement to OCR
Changes made: Conducting an accurate and thorough risk analysis of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of its ePHI
Developing and implementing a risk management plan to address and mitigate security risks and vulnerabilities identified in its risk analysis
Developing, maintaining, and revising, as necessary, its written policies and procedures to comply with the HIPAA Rules
Training its workforce members who have access to PHI on its HIPAA policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 32 weeks(223 days from discovery to filing)
Compliance flags: HHS report late · 223dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jun 1, 2019
→ Notified: Jan 10, 2020
223d 60 days HHS report late
HIPAA
Discovered: Jun 1, 2019
→ Notified: Jan 10, 2020
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jun 1, 2019 → Notified: Jan 10, 2020	223d	60 days	HHS report late
HIPAA	Discovered: Jun 1, 2019 → Notified: Jan 10, 2020	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 7 filings · 5 states

View merged incident ↗

Illinois State AGJan 1 · first

Massachusetts State AG+9d

New Hampshire State AG+9d

California State AG+9d

Indiana State AG+9d

HHS OCR+9d · this page

HHS OCR enforcement+1939d

Pattern: first filing Jan 1 (IL), last Apr 23 — a 1939-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jan 10, 2020
Raw hash: 3ff80bb08ee54ba4193555dd1c7feb875a7e18c4ecba1fa7de5d52d5ac48097c

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html4.2 KB

Download View at source

Linked disclosures

Regulatory filings (6) · sorted by filing gap

Reporting entityPIH HEALTH, INC.

Victim entityPIH HEALTH, INC.

Incidentdiscovered Jun 1, 2019

Stated responseAgreed to implement a corrective action plan monitored by OCR for two years

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing