MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedPHIHealth (basic)LowContained

Saco River Medical Group

bd_85a5bdd3d7b13719 · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 20, 2019

Filed

Oct 11, 2019

To disclose

21 days

Affected

1state residents only

Confidence

67%

Full breach record for Saco River Medical Group →2 incidents on file

Saco River Medical Group notified the NH AG and a patient that an employee accessed one patient's electronic medical record without authorization on or around September 20, 2019. The employee was suspended and required to undergo privacy training. Access to the specific record was restricted to the patient's physician and nurse.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 21 days

Sep 20, 2019

Discovered

Oct 11, 2019

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Saco River Medical Group
norm: saco river medical

Name: Saco River Medical Group
norm: saco river medical
Industry: Healthcarellm

Discovered: Sep 20, 2019
Materiality determined: —
Notification sent: Sep 24, 2019
Affected individuals: 1state-resident count only
Data types: PHIHealth (basic)
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified New Hampshire Office of the Attorney General
Initial access: insider_action

During the incident: Notified the patient
Suspended the employee without pay for two weeks
Placed the employee on probationary status for three months
Required the employee to undergo continuing education on patient privacy, confidentiality, and HIPAA
Locked the patient's chart so it can only be accessed by the patient's physician
Changes made: Added additional security to the electronic medical record
Restricted access to the patient's record to only the provider and her nurse
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/saco-river-medical-20191011.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Oct 11, 2019
Raw hash: 3c7c50162b25a8d953a00f936ca7917e3ce227401911a3f585d622673441f847

Reporting entitySaco River Medical Group

Victim entitySaco River Medical Group

Incidentdiscovered Sep 20, 2019

Stated responseNotified the patient

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov