CALIFORNIAPhysicalHealthcareHealthcareTheftCustomer Data InvolvedPHIHealth (basic)Identity (basic)MediumResolved

Milligan Chiropractic Group

bd_5a584d7088038761 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jan 31, 2018

Filed

Mar 30, 2018

To disclose

8 weeks

Affected

2,640

Linked

2 filings

Confidence

67%

Full breach record for Milligan Chiropractic Group →

Milligan Chiropractic Group, Inc. d/b/a Del Mar Chiropractic Sports Group reported to HHS on 2018-03-30 a Theft affecting 2640 individuals. Breached information located on Laptop.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jan 31, 2018 → Notified Mar 30, 201858d ✓ HHS report on time8 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 8 weeks / 58 days

Jan 31, 2018

Begins

Jan 31, 2018

Discovered

Mar 30, 2018

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_a5edfdbb0caa58b92018-03-30Verified

Name: Milligan Chiropractic Group
norm: milligan chiropractic
Industry: Health Care Services

Name: Milligan Chiropractic Group
norm: milligan chiropractic
Also named: Milligan Chiropractic Group, Inc.dba oflegal entity
Del Mar Chiropractic Sports Groupdba oftrade name
Industry: Healthcaresource default

Discovered: Jan 31, 2018
Breach occurred: Jan 31, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 30, 2018
Affected individuals: 2,640nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Theft
Where the data lived: Laptop
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External

During the incident: Provided breach notification to HHS, affected individuals, and the media
Encrypted data on laptops
Changed passwords
Implemented new safeguards
Revised policies and procedures
Trained workforce members
Changes made: Provided copies of its revised policies and procedures
Contracted with a third party to ensure HIPAA compliance for its electronic health records
Trained employees regarding its revised policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(58 days from discovery to filing)
Compliance flags: HHS report on time · 58dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jan 31, 2018
→ Notified: Mar 30, 2018
58d 60 days HHS report on time
HIPAA
Discovered: Jan 31, 2018
→ Notified: Mar 30, 2018
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jan 31, 2018 → Notified: Mar 30, 2018	58d	60 days	HHS report on time
HIPAA	Discovered: Jan 31, 2018 → Notified: Mar 30, 2018	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

California State AGMar 30 · first

HHS OCRMar 30 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Mar 30, 2018
Raw hash: a6dde0a03fbc5165b715e9ff3d8cd13ac3ae34acd39fef3f41ff7751d846f792

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.8 KB

Download View at source

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMilligan Chiropractic Group

Victim entityMilligan Chiropractic Group

Incidentdiscovered Jan 31, 2018

Stated responseProvided breach notification to HHS, affected individuals, and the media

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing