Top of the World Ranch
bd_6a69fb6630ef6fcb · schema v1 · pii pii-v1
Full breach record for Top of the World Ranch →Regulator's decision — not a breach notification
This record is a regulator's decision, not the organisation's own breach notice. Breach-notification fields (discovery date, notification clock) are structurally absent — what this source establishes is the outcome and the provisions the decision cites.
HHS OCR settled with Top of the World Ranch Treatment Center, LLC (TWRTC) for $103,000 regarding a breach of 1,980 individuals' PHI resulting from an email phishing attack. HHS's investigation indicated that TWRTC failed to conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of the electronic PHI it holds, as required by the Security Rule. The resolution agreement includes a Corrective Action Plan requiring risk analysis, risk management, policy updates, and workforce training.
J jump to incidentP pin to compareR raw source
Incident timeline — partial
? — ?
Breach window unknown
Jun 6, 2025
Filed
—
Corroborated · see linked filings
This record is the regulator's action, not a breach notice; its own dates cannot anchor compliance clocks. See the linked filings.
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- HHS OCRbd_45dfa4e8ea70175e2023-03-14 · +815dCandidate
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- instrument + outcome
- amount as filed (USD)
- CFR provisions
- the breach it recites
- discovery date
- notification clock
The dates the agreement recites belong to the underlying breach, years earlier, and are kept as evidence of WHICH breach rather than as this record’s timeline.