MAINEHackingHealthcareHealthcareBusiness Associate (HIPAA)Customer Data InvolvedPHIHEALTH_BASICIDENTITY_BASICFINANCIAL_ACCOUNTMediumContained
Penobscot Community Health Center, Inc.
bd_7e2e518293e755cb · schema v1 · pii pii-v1
Full breach record for Penobscot Community Health Center, Inc. →Penobscot Community Health Center, Inc. reported to HHS on 2019-07-12 a Hacking/IT Incident affecting 13299 individuals. Breached information located on Other. Business associate American Medical Collection Agency discovered unauthorized access to its web payment portal between August 1, 2018 and March 30, 2019. PHI involved included names, dates of birth, financial information, and clinical information.
HIPAA clock✓ HHS notified15 weeks discovery → filing
⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed13,299 affectedView incident
Source provenance
- Source URL
- https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
- Filed at
- Jul 12, 2019
- Raw hash
- 6420f63c504a8aade32c490bc1ecc37f66d6fe3ae65f2aeebf0663e4908621ae
Source filing
AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.
Reporting entity
- Name
- Penobscot Community Health Center, Inc.norm: penobscot community health center
- Industry
- Health Care Services
Victim entity
- Name
- Penobscot Community Health Center, Inc.norm: penobscot community health center
- Industry
- Healthcaresource default
Incident
- Discovered
- Mar 30, 2019
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- 13,299
- Data types
- PHIHEALTH_BASICIDENTITY_BASICFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- External
- Third party
- via American Medical Collection Agencybusiness associate
- Initial access
- exploit_public_facing
Compliance
- Time to disclose
- 15 weeks(104 days from discovery to filing)
- Compliance flags
- HHS notified
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status HIPAA Discovered: Mar 30, 2019→ Notified: not extracted— regulatory submission HHS notified
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.