MICHIGANPhysicalHealthcareHealthcareLossCustomer Data InvolvedPHIHealth (basic)Identity (basic)MediumResolved

Henry Ford Health System

bd_8aafe7a716197576 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 24, 2010

Filed

Nov 5, 2012

To disclose

26 months

Affected

2,777

Confidence

66%

Full breach record for Henry Ford Health System →10 incidents on file

Henry Ford Health System reported to HHS on 2012-11-05 a Loss affecting 2777 individuals. Breached information located on Other, Other Portable Electronic Device. The incident involved multiple losses of portable devices containing PHI between 2010 and 2014.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Sep 24, 2010 → Notified Nov 5, 2012773d ✗ HHS report late26 months discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 26 months / 773 days

Sep 24, 2010

Begins

Sep 24, 2010

Discovered

Nov 5, 2012

Filed

vs. sector median

+98 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,777 affectedView incident

Name: Henry Ford Health System
norm: henry ford health system
Domain: henryford.com
Industry: Health Care Services

Name: Henry Ford Health System
norm: henry ford health system
Domain: henryford.com
Industry: Healthcaresource default

Discovered: Sep 24, 2010
Breach occurred: Sep 24, 2010 – Oct 23, 2014
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 5, 2012
Affected individuals: 2,777nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Loss
Where the data lived: OtherPortable electronic device
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: Internal
Regulator citations: Notified HHSOCR provided substantial technical assistance to the CE on the Security Rule’s Risk Analysis requirements

During the incident: Sanctioned the employees involved in the breaches depending on the severity of the employees’ noncompliance
Implemented an encryption process to purchase 2,000 additional encryption licenses
Implemented a program for receiving and using encrypted flash drives
Provided breach notification to the affected individuals, the media, and HHS
Changes made: Create a more robust asset management program
Complete an enterprise data mapping and asset inventory
Submit a fully executed copy of the business associate agreement (BAA) to OCR upon signature of a Master Service Agreement (MSA) and Statement of Work (SOW) for data mapping services
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 months(773 days from discovery to filing)
Compliance flags: HHS report late · 773dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Sep 24, 2010
→ Notified: Nov 5, 2012
773d 60 days HHS report late
HIPAA
Discovered: Sep 24, 2010
→ Notified: Nov 5, 2012
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Sep 24, 2010 → Notified: Nov 5, 2012	773d	60 days	HHS report late
HIPAA	Discovered: Sep 24, 2010 → Notified: Nov 5, 2012	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Nov 5, 2012
Raw hash: 632762b4c257add151930e7b54e5d9d0020e64e6b842b113f8d20c81e36024ad

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html3.5 KB

Download View at source

Reporting entityHenry Ford Health System

Victim entityHenry Ford Health System

Incidentdiscovered Sep 24, 2010

Stated responseSanctioned the employees involved in the breaches depending on the severity of the employees’ noncompliance

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing