SOUTH CAROLINAPhysicalHealthcareHealthcareTheftCustomer Data InvolvedData ExfiltratedIDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTPCIAUTHENTICATIONHighResolved

Self Regional Healthcare

bd_6b5d6ca09eac9694 · schema v1 · pii pii-v1

Full breach record for Self Regional Healthcare →

On May 25, 2014, a password-protected but unencrypted laptop containing the PHI of 38,906 patients was stolen from Self Regional Healthcare's administrative offices in SC during a break-in. Breached data included names, SSNs, driver's license numbers, treating physician names, insurance policy numbers, account numbers, service dates, diagnosis/procedure information, payment card data, financial account information, and possibly addresses. The CE notified HHS, media, and individuals; offered credit monitoring; engaged police; revised HIPAA policies; retrained staff; improved physical access controls; and encrypted computers. OCR obtained assurances of corrective action.

HIPAA clock✓ HHS notified9 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed38,906 affectedView incident

Source provenance

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jul 25, 2014
Raw hash: 025fda56e0af2ea297c417ce4d0aefc553a8c7fa7555dff8365c7f80f0d58288

Source filing

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.0 KB

Download View at source

Reporting entity

Name: Self Regional Healthcare
norm: self regional healthcare
Industry: Health Care Services

Victim entity

Name: Self Regional Healthcare
norm: self regional healthcare
Industry: Health Care Services
Industry: Healthcaresource default

Incident

Discovered: May 25, 2014
Materiality determined: —
Notification sent: —
Affected individuals: 38,906
Data types: IDENTITY_BASICIDENTITY_GOVERNMENTHEALTH_BASICFINANCIAL_ACCOUNTPCIAUTHENTICATION
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: Reported to HHS OCROCR obtained assurances that corrective actions were implemented

Compliance

Time to disclose: 9 weeks(61 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: May 25, 2014
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: May 25, 2014 → Notified: not extracted	—	regulatory submission	HHS notified

Extraction provenance

Status: No extraction artifact recorded for this disclosure.