AccidentalHealthcareFinancial ServicesHealthcareMisdeliveryCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowResolved

Blue Cross and Blue Shield of Montana

bd_5e21453a7275c486 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jan 21, 2021

Filed

Feb 19, 2021

To disclose

29 days

Affected

1state residents only

Confidence

65%

Blue Cross and Blue Shield of Montana disclosed that on January 21, 2021, Protected Health Information (PHI) including names, DOBs, and claim numbers was inadvertently sent to the wrong recipient due to a processor error. The recipient was asked to destroy the data. No misuse was detected.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 29 days

Jan 21, 2021

Begins

Jan 21, 2021

Discovered

Feb 19, 2021

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Health Care Service Corp
norm: health care service
Domain: hcsc.com

Name: Blue Cross and Blue Shield of Montana
norm: blue cross and blue shield of montana
Domain: hcsc.com
Industry: HealthcarellmFinancial Servicesllm

Discovered: Jan 21, 2021
Breach occurred: Jan 21, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 19, 2021
Affected individuals: 1state-resident count only
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Misconfiguration

During the incident: Recipient was advised to destroy the PHI
Management is reinforcing with staff the importance of adhering to departmental, divisional or corporate policies and procedures
Changes made: Management is reinforcing with staff the importance of adhering to departmental, divisional or corporate policies and procedures to prevent disclosures of this nature from occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 29 days(29 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://dojmt.gov/wp-content/uploads/hcscSamp.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 19, 2021
Raw hash: 282028bb5b052b748c66cec3a6e542678eed314927444110df2bc756497c1bcf

Reporting entityHealth Care Service Corp

Victim entityBlue Cross and Blue Shield of Montana

Incidentdiscovered Jan 21, 2021

Stated responseRecipient was advised to destroy the PHI

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancedojmt.gov