WASHINGTONMisuseHealthcareHealthcareEmail MisuseCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)PHIHighResolved

Washington State Health Care Authority

bd_756a3c6f1bccb408 · schema v1 · pii pii-v1

Severity

High

Discovered

—

Filed

Feb 9, 2016

To disclose

—

Affected

91,187

Confidence

50%

Full breach record for Washington State Health Care Authority →2 incidents on file

Washington State Health Care Authority (HCA) reported to HHS on 2016-02-09 a breach involving unauthorized access/disclosure affecting 91,187 individuals. A workforce member impermissibly emailed protected health information to a personal email account. The breach involved data such as names, Social Security numbers, and clinical information located in email.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Feb 9, 2016

Filed

No interval is drawn: no breach start or discovery date is on record for this filing.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed91,187 affectedView incident

Name: Washington State Health Care Authority
norm: washington state health care authority
Industry: Insurance — Health

Name: Washington State Health Care Authority
norm: washington state health care authority
Industry: Insurance — Health
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 91,187nationwide
Data types: Identity (basic)Government IDHealth (basic)PHI
HHS breach type: Unauthorized access or disclosure
Where the data lived: Email
Covered-entity type: Health plan
Attack vector: Unauthorized Access
Threat actor: Internal
Regulator citations: Notified HHSOCR obtained written assurances that the CE implemented corrective actions.

Changes made: Updated all relevant policies and procedures
Implemented additional security measures
Retrained employees
Updated access management program
Hired new staff to focus solely on managing access to electronic systems
Sanctioned the employee involved in the breach
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 9, 2016
Raw hash: 631c5ff5b549b9fb917a3dc62231cd1bff4094107efe45ffad060677c5b92e20

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.9 KB

Download View at source

Reporting entityWashington State Health Care Authority

Victim entityWashington State Health Care Authority

IncidentUnauthorized Access

Stated responseUpdated all relevant policies and procedures

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing