PUERTO RICOPhysicalHealthcareGovernmentHealthcareLossCustomer Data InvolvedDelayed DiscoveryHealth (basic)Identity (basic)Government IDHighResolved

Departamento de Salud de Puerto Rico

bd_5b0351d0c8d2b29f · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 14, 2010

Filed

Feb 22, 2011

To disclose

49 weeks

Affected

2,621

Confidence

92%

Full breach record for Departamento de Salud de Puerto Rico →

Departamento de Salud de Puerto Rico (Puerto Rico Department of Health) reported to HHS OCR on 2011-02-22 a Loss affecting 2,621 individuals. On March 14, 2010, a computer hard drive was lost or stolen from the Alzheimer's Registry Program Department. The hard drive contained ePHI including patient names, addresses, dates of birth, Social Security numbers, diagnoses, and treatment information. Breached information was located on an Other Portable Electronic Device. No business associate was involved. The CE conducted risk analyses, retrained staff, notified affected individuals, and provided one year of credit protection.

J jump to incidentP pin to compareR raw source

HIPAA clock✗ HHS report late49 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 49 weeks / 345 days

Mar 14, 2010

Begins

Mar 14, 2010

Discovered

Feb 22, 2011

Filed

vs. sector median

+37 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,621 affectedView incident

Name: Departamento de Salud de Puerto Rico
norm: departamento de salud de puerto rico
Industry: Health Care Services

Name: Departamento de Salud de Puerto Rico
norm: departamento de salud de puerto rico
Industry: Health Care Services
Industry: Healthcaresource defaultGovernmentllm

Discovered: Mar 14, 2010
Breach occurred: Mar 14, 2010
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 2,621nationwide
Data types: Health (basic)Identity (basic)Government ID
HHS breach type: Loss
Where the data lived: Portable electronic device
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: HHS OCR obtained assurances that the covered entity implemented corrective actions.

During the incident: Provided breach notification to affected individuals.
Provided one year of credit protection to affected individuals.
OCR obtained assurances of corrective action implementation.
Changes made: Conducted risk analyses and implemented risk management plans across multiple affiliated entities including Hospital Universitario Dr. Ramon Ruiz Arnau, Administración de Servicios Médicos de Puerto Rico, University Pediatric Hospital, Oficina Central para Asuntos del SIDA y Enfermedades Transmisibles, and the Ryan White program.
Reviewed HIPAA Privacy and Security Rule policies and procedures.
Retrained staff in 2017 and 2018.
Expected to conduct risk analysis and implement remediation plans for Medicaid Department, Emergency Department in Loiza, WIC Department, Intellectual Disability Department, Immunization Department, Demographic Registry Department, and Local Centers for Diagnosis and Treatment in Vieques and Adjuntas.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 49 weeks(345 days from discovery to filing)
Compliance flags: HHS report lateHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Mar 14, 2010
→ Notified: not extracted
— 60 days HHS report late
HIPAA
Discovered: Mar 14, 2010
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Mar 14, 2010 → Notified: not extracted	—	60 days	HHS report late
HIPAA	Discovered: Mar 14, 2010 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 22, 2011
Raw hash: f939cc5e133216f062467d54d4eae9f9609a674217bd4246f481b1932d53bf04

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.5 KB

Download View at source

Reporting entityDepartamento de Salud de Puerto Rico

Victim entityDepartamento de Salud de Puerto Rico

Incidentdiscovered Mar 14, 2010

Stated responseProvided breach notification to affected individuals.

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing