AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedPHIGovernment IDIdentity (basic)Health (basic)MediumResolved

WestCoast Children's Clinic

bd_66eaa3bf5c884362 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 27, 2012

Filed

Nov 29, 2012

To disclose

2 days

Affected

Not disclosed

Confidence

65%

Full breach record for WestCoast Children's Clinic →2 incidents on file

WestCoast Children's Clinic disclosed an unintentional email misdelivery of a referral document containing PHI (name, DOB, SSN, address, health concerns) to an unauthorized county social worker. The incident occurred on Nov 20, 2012, and was discovered on Nov 27, 2012. The unintended recipient deleted the data. The clinic implemented policy changes, retraining, and disciplinary actions.

J jump to incidentP pin to compareR raw source

California clockDiscovered Nov 27, 2012 → Notified Nov 29, 20122d ✓ CA 60-day OK2 days discovery → filing

Incident timeline

undetected · 7 days

discovery → filing · 2 days

Nov 20, 2012

Begins

Nov 27, 2012

Discovered

Nov 29, 2012

Filed

vs. sector median

11 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: WestCoast Children's Clinic
norm: westcoast children s clinic
Domain: westcoastcc.org

Name: WestCoast Children's Clinic
norm: westcoast children s clinic
Domain: westcoastcc.org
Industry: Healthcarellm

Discovered: Nov 27, 2012
Breach occurred: Nov 20, 2012
Undetected for: 7 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 29, 2012
Affected individuals: Not disclosed
Data types: PHIGovernment IDIdentity (basic)Health (basic)
Attack vector: Unknown
Regulator citations: Reported this breach to California Office of the Attorney GeneralWill report this breach to the United States Department of Health & Human Services

During the incident: Investigated the breach to determine how this unintentional error resulted in the release of your protected health information
Notified the unintended recipient who has confirmed that your information was permanently deleted from that email account
Ensured that any existing copies of this document were securely deleted on our network
Reported this breach to California Office of the Attorney General
Will report this breach to the United States Department of Health & Human Services
Changes made: Reviewed our existing policies and procedures
Conducting a self-audit of our procedures to identify any vulnerability that could result in this error occurring again
Changed our practices of providing referral forms to outside agencies in order to protect against another inadvertent sharing of private information
Employees involved will receive disciplinary sanctions consistent with the level of privacy breach
Employees involved will be re-trained in privacy practices
All of our employees will be contacted to remind them of the priorities in protecting health information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 2 days(2 days from discovery to filing)
Compliance flags: CA 60-day OK · 2d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Nov 27, 2012
→ Notified: Nov 29, 2012
2d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Nov 27, 2012 → Notified: Nov 29, 2012	2d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-37088
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 29, 2012
Raw hash: 6960348ccaad762ca327eb614b42b12b7adc5a8d88f3dcfe3cf794340a714f3f

Reporting entityWestCoast Children's Clinic

Victim entityWestCoast Children's Clinic

Incidentdiscovered Nov 27, 2012

Stated responseInvestigated the breach to determine how this unintentional error resulted in the release of your protected health information

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov