KENTUCKYMalwareHealthcareHealthcareRansomwareData EncryptedRansom DemandedRansom PaidCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountFinancial credentialsHighResolved

Jennie Stuart Medical Center, Inc.

bd_557e3a80da849243 · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Sep 23, 2016

To disclose

—

Affected

1,500

Confidence

98%

Full breach record for Jennie Stuart Medical Center, Inc. →

Jennie Stuart Medical Center (KY) reported to HHS OCR on 2016-09-23 a Hacking/IT Incident affecting 1,500 individuals. Hackers deployed ransomware on the CE's network server, encrypting data on top of existing CE encryption and demanding a ransom, which the CE paid. Breached PHI included names, addresses, dates of birth, SSNs, driver's license data, claims, credit card/bank account information, medical diagnoses, lab results, and medications. A forensic investigation was conducted and OCR obtained assurances of remediation.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Sep 23, 2016

Filed

—

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,500 affectedView incident

Name: Jennie Stuart Medical Center, Inc.
norm: jennie stuart medical center
Industry: Health Care Services

Name: Jennie Stuart Medical Center, Inc.
norm: jennie stuart medical center
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 1,500nationwide
Data types: Identity (basic)Government IDHealth (basic)Financial accountFinancial credentials
HHS breach type: Hacking / IT incident
Where the data lived: Network server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: OCR received full forensic investigation reportOCR obtained assurances of remediation actions

During the incident: Hired third party for forensic investigation
Paid ransom to regain access to encrypted data
Expanded data security monitoring
Updated security management policies
Provided additional staff training
Changes made: Expanded data security monitoring
Updated security management policies
Additional staff training
Risk assessment analysis provided to OCR
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Sep 23, 2016
Raw hash: b89c5964bdc53802e07d0c0c055c23209ec58726d3dfa588b7cdea48225d227d

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.1 KB

Download View at source

Reporting entityJennie Stuart Medical Center, Inc.

Victim entityJennie Stuart Medical Center, Inc.

IncidentUnauthorized Access

Stated responseHired third party for forensic investigation

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing