ILLINOISAccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedIdentity (basic)PHILowContained

DePaul University

bd_57b362f44bdb2288 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 14, 2018

Filed

Dec 21, 2018

To disclose

7 days

Affected

656

Confidence

67%

Full breach record for DePaul University →

DePaul University reported to HHS on 2018-12-21 a Unauthorized Access/Disclosure affecting 656 individuals. Breached information located on Email. An employee inadvertently sent an email to health plan wellness program participants without blind copying, exposing recipient names.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Dec 14, 2018 → Notified Dec 21, 20187d ✓ HHS report on time7 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 7 days

Dec 14, 2018

Begins

Dec 14, 2018

Discovered

Dec 21, 2018

Filed

vs. sector median

12 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed656 affectedView incident

Name: DePaul University
norm: depaul university
Industry: Insurance — Health

Name: DePaul University
norm: depaul university
Industry: Healthcaresource default

Discovered: Dec 14, 2018
Breach occurred: Dec 14, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Dec 21, 2018
Affected individuals: 656nationwide
Data types: Identity (basic)PHI
HHS breach type: Unauthorized access or disclosure
Where the data lived: Email
Covered-entity type: Health plan
Attack vector: Misconfiguration
MITRE ATT&CK: T1530 Data from Cloud Storage
Threat actor: Internal

During the incident: Provided breach notification to HHS, affected individuals, and the media
Send an email to recipients requesting that they delete the erroneous email
Counseled and educated the employee who sent the email
Provided HIPAA refresher training to the benefits staff
Changes made: Implemented a new process to automate blind copying of recipients for any group email distribution or notices related to the CE's health and welfare benefits plan
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 7 days(7 days from discovery to filing)
Compliance flags: HHS report on time · 7dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Dec 14, 2018
→ Notified: Dec 21, 2018
7d 60 days HHS report on time
HIPAA
Discovered: Dec 14, 2018
→ Notified: Dec 21, 2018
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Dec 14, 2018 → Notified: Dec 21, 2018	7d	60 days	HHS report on time
HIPAA	Discovered: Dec 14, 2018 → Notified: Dec 21, 2018	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Dec 21, 2018
Raw hash: bb80ffa40a6c860299087245d2d76813398be8dc200ac26f218b6f31b6afe4e1

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.8 KB

Download View at source

Reporting entityDePaul University

Victim entityDePaul University

Incidentdiscovered Dec 14, 2018

Stated responseProvided breach notification to HHS, affected individuals, and the media

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing