MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedCustomer Data InvolvedPHIHealth (basic)Identity (basic)Government IDMediumResolved

California Pacific Medical Center

bd_59a42b43d70adf9e · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 10, 2014

Filed

Jan 23, 2015

To disclose

15 weeks

Affected

844state residents only

Linked

2 filings

Confidence

66%

Full breach record for California Pacific Medical Center →

California Pacific Medical Center (CPMC) notified 844 patients after an audit revealed a pharmacist employee accessed their records without a business or treatment purpose between October 2013 and October 2014. The accessed data included patient demographics, last four digits of SSN, clinical information, and prescription details. CPMC terminated the employee and notified affected individuals. No evidence of malicious intent or unauthorized sharing was found.

J jump to incidentP pin to compareR raw source

California clockDiscovered Oct 10, 2014 → Notified Oct 21, 201411d ✓ CA 60-day OK15 weeks discovery → filing

Incident timeline

undetected · 374 days

discovery → filing · 15 weeks / 105 days

Oct 1, 2013

Begins

Oct 10, 2014

Discovered

Jan 23, 2015

Filed

vs. sector median

+3 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_9cfedf44e9c501fe2015-01-23Verified

Name: California Pacific Medical Center
norm: california pacific medical center

Name: California Pacific Medical Center
norm: california pacific medical center
Industry: Healthcarellm

Discovered: Oct 10, 2014
Breach occurred: Oct 1, 2013 – Oct 31, 2014
Undetected for: 374 daysoccurrence → discovery
Materiality determined: —
Notification sent: Oct 21, 2014
Affected individuals: 844state-resident count only
Data types: PHIHealth (basic)Identity (basic)Government ID
Data elements: Social Security numberMedical information
Attack vector: Insider
Threat actor: Internal
Initial access: insider_action

During the incident: Terminated its relationship with the employee
Broadened the investigation
Notified all of these patients
Reiterated to all staff that policy allows them to access patient information only when necessary to perform job duties
Changes made: Reiterated to all staff that policy allows them to access patient information only when necessary to perform job duties and that violating this policy may result in loss of employment
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 15 weeks(105 days from discovery to filing)
Compliance flags: CA 60-day OK · 11d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Oct 10, 2014
→ Notified: Oct 21, 2014
11d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Oct 10, 2014 → Notified: Oct 21, 2014	11d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRJan 23 · first

California State AGJan 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-48217
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 23, 2015
Raw hash: 2bee94649f86b29fdc97551c46f443bad26c503eaa5e43a6ea8b79f64745287e

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCalifornia Pacific Medical Center

Victim entityCalifornia Pacific Medical Center

Incidentdiscovered Oct 10, 2014

Stated responseTerminated its relationship with the employee

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov