CALIFORNIAHackingHealthcareHealthcareCustomer Data InvolvedPHIHealth (basic)Identity (basic)Financial accountMediumContained

RADY CHILDREN'S HOSPITAL SAN DIEGO

bd_50d81353ec6275ba · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 21, 2020

Filed

Feb 21, 2020

To disclose

—

Affected

2,360

Linked

4 filings

Confidence

68%

Full breach record for RADY CHILDREN'S HOSPITAL SAN DIEGO →5 incidents on file

Rady Children's Hospital San Diego reported to HHS on 2020-02-21 a Unauthorized Access/Disclosure affecting 2360 individuals. Breached information located on Network Server. A vulnerability on the network server allowed ePHI (names, financial, and treatment info) to be accessible via the Internet. The entity notified HHS, individuals, and media, provided credit monitoring, and implemented additional safeguards.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Feb 21, 2020 → Notified Feb 21, 20200d ✓ HHS report on time

⚠ notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.

Incident timeline

discovery → filing · ≤1 day / 0 days

Feb 21, 2020

Discovered

Feb 21, 2020

Filed

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

California State AGbd_97f45a0d9ce3b6e02020-02-21Verified
Illinois State AGbd_87155618926f2c9d2020-01-01 · +51dVerified
Illinois State AGbd_dfd3e74f7b493c9c2020-01-01 · +51dVerified

Name: RADY CHILDREN'S HOSPITAL SAN DIEGO
norm: rady children s hospital san diego
Industry: Health Care Services

Name: RADY CHILDREN'S HOSPITAL SAN DIEGO
norm: rady children s hospital san diego
Industry: Healthcaresource default

Discovered: Feb 21, 2020
Materiality determined: —
Notification sent: Feb 21, 2020
Affected individuals: 2,360nationwide
Data types: PHIHealth (basic)Identity (basic)Financial account
HHS breach type: Unauthorized access or disclosure
Where the data lived: Network server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: External
Regulator citations: Notified HHS
Initial access: exploit_public_facing

During the incident: Notified HHS
Notified affected individuals
Notified the media
Provided substitute notice
Provided complimentary credit monitoring services
Changes made: Implemented additional administrative and technical safeguards
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS report on time · 0dHHS notified
Discovery-date grounding: notification dateThe stored discovery date equals the NOTIFICATION date, collapsing the clock to ~zero. This UNDERSTATES the delay and can mask a real violation.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Feb 21, 2020
→ Notified: Feb 21, 2020
0d 60 days HHS report on time
HIPAA
Discovered: Feb 21, 2020
→ Notified: Feb 21, 2020
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Feb 21, 2020 → Notified: Feb 21, 2020	0d	60 days	HHS report on time
HIPAA	Discovered: Feb 21, 2020 → Notified: Feb 21, 2020	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 2 states

View merged incident ↗

Illinois State AGJan 1 · first

California State AG+51d

HHS OCR+51d · this page

Pattern: first filing Jan 1 (IL), last Feb 21 (CA) — a 51-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 21, 2020
Raw hash: 8ed91f6e41934c2e32dc924c1cd8dd79f11da042cb7e516fac4b7d0942660c8f

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.6 KB

Download View at source

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityRADY CHILDREN'S HOSPITAL SAN DIEGO

Victim entityRADY CHILDREN'S HOSPITAL SAN DIEGO

Incidentdiscovered Feb 21, 2020

Stated responseNotified HHS

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing