CALIFORNIAPhysicalHealthcareHealthcareTheftCustomer Data InvolvedHealth (basic)Identity (basic)LowResolved

Denise M. Bowden, LAc

bd_4c4b7c79167969a8 · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 28, 2018

Filed

Jun 11, 2018

To disclose

6 weeks

Affected

538

Linked

2 filings

Confidence

98%

Full breach record for Denise M. Bowden, LAc →

On April 28, 2018, a burglar stole a desktop computer from the office of Denise M. Bowden, LAc, a licensed acupuncturist in CA. The computer contained PHI of 538 individuals, including demographic and clinical information. The CE notified police and provided breach notifications to HHS, affected individuals, and media, and offered free credit monitoring. Following OCR's investigation, the CE reset passcodes, implemented MFA, installed a security camera, trained staff, and updated policies for safeguarding PHI.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Apr 28, 2018 → Notified Jun 11, 201844d ✓ HHS report on time6 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 6 weeks / 44 days

Apr 28, 2018

Begins

Apr 28, 2018

Discovered

Jun 11, 2018

Filed

vs. sector median

6 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_323ea204580b08082018-06-11Verified by operator

Name: Denise M. Bowden, LAc
norm: denise m bowden lac
Industry: Health Care Services

Name: Denise M. Bowden, LAc
norm: denise m bowden lac
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Apr 28, 2018
Breach occurred: Apr 28, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 11, 2018
Affected individuals: 538nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: Theft
Where the data lived: Desktop computer
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: HHS OCR investigation; CE reset passcodes, implemented multi-factor authentication, installed security camera, trained staff, and provided OCR with copies of policies and procedures for safeguarding PHI.

During the incident: Notified police
Breach notification to HHS, affected individuals, and media
Changes made: Notified police
Provided breach notification to HHS, affected individuals, and the media
Provided free credit monitoring
Strengthened password requirements for electronic systems
Improved physical security
Reset passcodes
Implemented multi-factor authentication
Installed a security camera
Trained staff
Provided OCR with copies of policies and procedures for safeguarding PHI
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(44 days from discovery to filing)
Compliance flags: HHS report on time · 44dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Apr 28, 2018
→ Notified: Jun 11, 2018
44d 60 days HHS report on time
HIPAA
Discovered: Apr 28, 2018
→ Notified: Jun 11, 2018
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Apr 28, 2018 → Notified: Jun 11, 2018	44d	60 days	HHS report on time
HIPAA	Discovered: Apr 28, 2018 → Notified: Jun 11, 2018	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

California State AGJun 11 · first

HHS OCRJun 11 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jun 11, 2018
Raw hash: 9f619870e3f26426de23ad64c7d0e925d51cafb959ebaaa935594249acc3e77b

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.7 KB

Download View at source

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityDenise M. Bowden, LAc

Victim entityDenise M. Bowden, LAc

Incidentdiscovered Apr 28, 2018

Stated responseNotified police

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing