MISSOURIMisuseHealthcareGovernmentHealthcarePrivilege AbuseEmail MisuseCustomer Data InvolvedData ExfiltratedEmployee Data InvolvedIdentity (basic)Government IDHealth (basic)HighResolved

Saint Louis County Department of Health

bd_6184db12dfd11a40 · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Jan 7, 2015

To disclose

—

Affected

4,000

Confidence

97%

Full breach record for Saint Louis County Department of Health →

On November 18, 2014, a departing employee of Saint Louis County Department of Health (MO) emailed a reconciliation spreadsheet containing PHI of ~4,000 patients to her personal email account upon resignation. Exposed data included names, Social Security numbers, and dates of service. The CE filed a police report, terminated the employee's access, notified HHS/affected individuals/media, and retrained staff on HIPAA. OCR obtained assurances of corrective action. Breach submitted to HHS on 2015-01-07; located on Email and Network Server.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline

Nov 18, 2014

Begins

Jan 7, 2015

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4,000 affectedView incident

Name: Saint Louis County Department of Health
norm: saint louis county department of health
Industry: Health Care Services

Name: Saint Louis County Department of Health
norm: saint louis county department of health
Industry: Health Care Services
Industry: Healthcaresource defaultGovernmentllm

Discovered: Not extracted — the OCR public portal omits it
Breach occurred: Nov 18, 2014
Materiality determined: —
Notification sent: —
Affected individuals: 4,000nationwide
Data types: Identity (basic)Government IDHealth (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: EmailNetwork server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical MediumT1078 Valid Accounts
Threat actor: Internal
Regulator citations: HHS OCR — corrective action plan accepted; OCR obtained assurances of implementation
Initial access: insider_action

During the incident: Breach notification provided to HHS, affected individuals, and media
Police report filed
Former employee's access to patient database terminated
Employees retrained on HIPAA policies and procedures
Changes made: Terminated former employee's system access
Employee retraining on HIPAA policies and procedures
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jan 7, 2015
Raw hash: 599153a185eda20e18b017d6fe8d7ca47b620f1e5bb53035e9fb8119b56ff5af

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.8 KB

Download View at source

Reporting entitySaint Louis County Department of Health

Victim entitySaint Louis County Department of Health

IncidentUnauthorized Access

Stated responseBreach notification provided to HHS, affected individuals, and media

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing