CALIFORNIAPhysicalHealthcareHealthcareLossBusiness Associate (HIPAA)Customer Data InvolvedHealth (basic)Identity (basic)Financial accountMediumResolved

Port City Operating Company

bd_864cb77470f26eb6 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Aug 9, 2018

Filed

Aug 31, 2018

To disclose

22 days

Affected

4,984

Linked

2 filings

Confidence

96%

Full breach record for Port City Operating Company →

On August 9, 2018, St. Joseph's Medical Center (Port City Operating Company) discovered that hard drives from two old laboratory machine analyzers were missing during removal and replacement. The drives contained ePHI of approximately 4,984 individuals, including names, dates of birth, genders, account information, lab tests, test results, and ordering physicians. The CE and its BA searched facilities and interviewed staff but could not recover the drives. Breach notifications were sent to HHS, affected individuals, and media. The BA updated policies/procedures and retrained staff; OCR confirmed corrective actions. Breached info located on Other Portable Electronic Device.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time22 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 22 days

Aug 9, 2018

Begins

Aug 9, 2018

Discovered

Aug 31, 2018

Filed

vs. sector median

9 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_707aae194c4b6c4e2018-08-31Verified

Name: Port City Operating Company
norm: port city operating
Industry: Health Care Services

Name: Port City Operating Company
norm: port city operating
Industry: Health Care Services
Also named: Port City Operating Companydba oflegal entity
St. Joseph's Medical Centerdba oftrade name
Industry: Healthcaresource default

Discovered: Aug 9, 2018
Breach occurred: Aug 9, 2018
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 4,984nationwide
Data types: Health (basic)Identity (basic)Financial account
HHS breach type: Loss
Where the data lived: Portable electronic device
Covered-entity type: Healthcare providerBusiness associate involved
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: OCR obtained assurances that the CE/BA implemented corrective actions including updated policies and procedures and retraining of workforce members.

During the incident: Searched facilities and interviewed staff
Provided breach notification to HHS, affected individuals, and the media
Business associate updated policies and procedures
Business associate retrained workforce members
Changes made: BA updated policies and procedures
BA retrained workforce members
OCR-confirmed corrective action implementation
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 22 days(22 days from discovery to filing)
Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Aug 9, 2018
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Aug 9, 2018
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Aug 9, 2018 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Aug 9, 2018 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

California State AGAug 31 · first

HHS OCRAug 31 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Aug 31, 2018
Raw hash: 3f182a3ec86e706c388ce31fe751ef182c5b4691d9ca36944963fc1f37e6de15

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.9 KB

Download View at source

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPort City Operating Company

Victim entityPort City Operating Company

Incidentdiscovered Aug 9, 2018

Stated responseSearched facilities and interviewed staff

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing