MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedTargetedIdentity (basic)Health (basic)FinancialLowResolved

Littleton Regional Hospital

bd_5aad7306d55467b4 · schema v1 · pii pii-v1

Severity

Low

Discovered

May 21, 2010

Filed

Jun 29, 2010

To disclose

6 weeks

Affected

Not disclosed

Confidence

65%

Littleton Regional Hospital notified the NH Attorney General and patients of an insider breach in May 2010. An employee improperly accessed patient PHI (demographics, medical history, insurance) for non-treatment purposes. The employee was terminated and staff retrained. No third-party disclosure was found.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 20 days

discovery → filing · 6 weeks / 39 days

May 1, 2010

Begins

May 21, 2010

Discovered

Jun 29, 2010

Filed

vs. sector median

7 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: Littleton Regional Hospital
norm: littleton regional hospital

Name: Littleton Regional Hospital
norm: littleton regional hospital
Industry: Healthcarellm

Discovered: May 21, 2010
Breach occurred: May 1, 2010 – May 31, 2010
Undetected for: 20 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 29, 2010
Affected individuals: Not disclosed
Data types: Identity (basic)Health (basic)Financial
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Provided notice to the New Hampshire Office of the Attorney GeneralProvided notice to the Secretary of the Department of Health and Human Services
Initial access: insider_action

During the incident: Appropriate disciplinary action has been taken in this matter
The employee who engaged in this improper behavior is no longer employed by the hospital
Provided additional education to staff of Littleton Regional Hospital and its Physician Practices regarding federal and state privacy laws
Provided notice to the New Hampshire Office of the Attorney General
Provided notice to the Secretary of the Department of Health and Human Services
Changes made: Provided additional education to staff of Littleton Regional Hospital and its Physician Practices regarding federal and state privacy laws
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(39 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/littleton-hospital-20100629.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 29, 2010
Raw hash: 64c794a4fe4999d5e8ed36c72701ae3b2ea145b5bc7ae75ac1432565d50f095c

Reporting entityLittleton Regional Hospital

Victim entityLittleton Regional Hospital

Incidentdiscovered May 21, 2010

Stated responseAppropriate disciplinary action has been taken in this matter

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov