ALABAMAMisuseHealthcareGovernmentHealthcarePrivilege AbuseData MishandlingCustomer Data InvolvedData ExfiltratedTargetedHealth (basic)Identity (basic)Government IDHighResolved

Alabama Department of Public Health

bd_4c5ae6ed3f1e253d · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 21, 2014

Filed

Jun 26, 2014

To disclose

14 weeks

Affected

1,200

Confidence

95%

Full breach record for Alabama Department of Public Health →

Alabama Department of Public Health reported to HHS OCR on 2014-06-26 a Theft (insider disclosure) affecting approximately 1,200 individuals. An employee disclosed PHI from Electronic Medical Records to a third party, potentially for tax fraud purposes. Federal law enforcement informed the entity on 2014-03-21. The employee was criminally indicted by the U.S. District Court, Middle District of Alabama, and is no longer employed. Additional safeguards were implemented.

J jump to incidentP pin to compareR raw source

HIPAA clock✗ HHS report late14 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 14 weeks / 97 days

Mar 21, 2014

Discovered

Jun 26, 2014

Filed

vs. sector median

+5 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,200 affectedView incident

Name: Alabama Department of Public Health
norm: alabama department of public health
Industry: Health Care Services

Name: Alabama Department of Public Health
norm: alabama department of public health
Industry: Health Care Services
Industry: Healthcaresource defaultGovernmentllm

Discovered: Mar 21, 2014
Materiality determined: —
Notification sent: —
Affected individuals: 1,200nationwide
Data types: Health (basic)Identity (basic)Government ID
HHS breach type: Theft
Where the data lived: Electronic medical record
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
Threat actor: InternalFinancial
Regulator citations: HHS OCR breach notification filed 2014-06-26
Initial access: insider_action

During the incident: Federal law enforcement notified the covered entity of the breach on 2014-03-21
Workforce member was indicted by U.S. District Court, Middle District of Alabama
Workforce member responsible for breach is no longer employed by the covered entity
Additional safeguards implemented following the breach
Changes made: Termination of employee responsible
Implementation of additional safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(97 days from discovery to filing)
Compliance flags: HHS report lateHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Mar 21, 2014
→ Notified: not extracted
— 60 days HHS report late
HIPAA
Discovered: Mar 21, 2014
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Mar 21, 2014 → Notified: not extracted	—	60 days	HHS report late
HIPAA	Discovered: Mar 21, 2014 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jun 26, 2014
Raw hash: cda0062d80155957f61abc0a5cd7d46ca200180f984277f20f47386c5d7285ad

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.5 KB

Download View at source

Reporting entityAlabama Department of Public Health

Victim entityAlabama Department of Public Health

Incidentdiscovered Mar 21, 2014

Stated responseFederal law enforcement notified the covered entity of the breach on 2014-03-21

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing