CALIFORNIAHackingHealthcareHealthcareCustomer Data InvolvedPHIHealth (basic)Identity (basic)Financial accountMediumContained

RADY CHILDREN'S HOSPITAL SAN DIEGO

bd_50d81353ec6275ba · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 3, 2020

Filed

Feb 21, 2020

To disclose

7 weeks

Affected

2,360

Linked

4 filings

Confidence

68%

Full breach record for RADY CHILDREN'S HOSPITAL SAN DIEGO →5 incidents on file

Rady Children's Hospital San Diego reported to HHS on 2020-02-21 a Unauthorized Access/Disclosure affecting 2360 individuals. Breached information located on Network Server. A vulnerability on the network server allowed ePHI (names, financial, and treatment info) to be accessible via the Internet. The entity notified HHS, individuals, and media, provided credit monitoring, and implemented additional safeguards.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jan 3, 2020 → Notified Feb 21, 202049d ✓ HHS report on time7 weeks discovery → filing

Incident timeline

discovery → filing · 7 weeks / 49 days

Jan 3, 2020

Discovered

Feb 21, 2020

Filed

vs. sector median

2 wks faster

This filing is one of 4 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_97f45a0d9ce3b6e02020-02-21Verified
Illinois State AGbd_87155618926f2c9d2020-01-01 · +51dVerified
Illinois State AGbd_dfd3e74f7b493c9c2020-01-01 · +51dVerified

Name: RADY CHILDREN'S HOSPITAL SAN DIEGO
norm: rady children s hospital san diego
Industry: Health Care Services

Name: RADY CHILDREN'S HOSPITAL SAN DIEGO
norm: rady children s hospital san diego
Industry: Healthcaresource default

Discovered: Jan 3, 2020
Materiality determined: —
Notification sent: Feb 21, 2020
Affected individuals: 2,360nationwide
Data types: PHIHealth (basic)Identity (basic)Financial account
HHS breach type: Unauthorized access or disclosure
Where the data lived: Network server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified HHS
Initial access: exploit_public_facing

During the incident: Notified HHS
Notified affected individuals
Notified the media
Provided substitute notice
Provided complimentary credit monitoring services
Changes made: Implemented additional administrative and technical safeguards
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 weeks(49 days from discovery to filing)
Compliance flags: HHS report on time · 49dHHS notified
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jan 3, 2020
→ Notified: Feb 21, 2020
49d 60 days HHS report on time
HIPAA
Discovered: Jan 3, 2020
→ Notified: Feb 21, 2020
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jan 3, 2020 → Notified: Feb 21, 2020	49d	60 days	HHS report on time
HIPAA	Discovered: Jan 3, 2020 → Notified: Feb 21, 2020	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 2 states

View merged incident ↗

Illinois State AGJan 1 · first

California State AG+51d

HHS OCR+51d · this page

Pattern: first filing Jan 1 (IL), last Feb 21 (CA) — a 51-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 21, 2020
Raw hash: 8ed91f6e41934c2e32dc924c1cd8dd79f11da042cb7e516fac4b7d0942660c8f

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.6 KB

Download View at source

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityRADY CHILDREN'S HOSPITAL SAN DIEGO

Victim entityRADY CHILDREN'S HOSPITAL SAN DIEGO

Incidentdiscovered Jan 3, 2020

Stated responseNotified HHS

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing