KENTUCKYAccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedIdentity (basic)PHIMediumResolved

Women's Care of Somerset

bd_8c7056fe5f51cc27 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 3, 2017

Filed

Mar 31, 2017

To disclose

8 weeks

Affected

1,806

Confidence

65%

Full breach record for Women's Care of Somerset →

Women's Care of Somerset reported to HHS on 2017-03-31 a Unauthorized Access/Disclosure affecting 1806 individuals. Breached information located on Email. An office manager sent a promotional email to patients without blind copying, disclosing email addresses.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Feb 3, 2017 → Notified Feb 3, 20170d ✓ HIPAA individual notice OK8 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 8 weeks / 56 days

Feb 3, 2017

Begins

Feb 3, 2017

Discovered

Mar 31, 2017

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,806 affectedView incident

Name: Women's Care of Somerset
norm: women s care of somerset
Industry: Health Care Services

Name: Women's Care of Somerset
norm: women s care of somerset
Industry: Healthcaresource default

Discovered: Feb 3, 2017
Breach occurred: Feb 3, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 3, 2017
Affected individuals: 1,806nationwide
Data types: Identity (basic)PHI
HHS breach type: Unauthorized access or disclosure
Where the data lived: Email
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1530 Data from Cloud Storage Object
Threat actor: Internal
Regulator citations: provided breach notification to HHSOCR obtained assurances that the CE implemented the corrective actions
Initial access: insider_action

During the incident: Sanctioned the office manager
Deleted the emails
Disabled the email account that was used to send them
Provided breach notification to HHS, the affected individuals, the media, and posted substitute notice on the CE’s website
Changes made: Revised its electronic mail use policy
Required staff to review the revised policy
Retrained staff on proper email use
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: HIPAA individual notice OK · 0dHHS report on time · 0dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Feb 3, 2017
→ Notified: Feb 3, 2017
0d 60 days HIPAA individual notice OK
HIPAA
Discovered: Feb 3, 2017
→ Notified: Feb 3, 2017
0d 60 days HHS report on time
HIPAA
Discovered: Feb 3, 2017
→ Notified: Feb 3, 2017
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Feb 3, 2017 → Notified: Feb 3, 2017	0d	60 days	HIPAA individual notice OK
HIPAA	Discovered: Feb 3, 2017 → Notified: Feb 3, 2017	0d	60 days	HHS report on time
HIPAA	Discovered: Feb 3, 2017 → Notified: Feb 3, 2017	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Mar 31, 2017
Raw hash: 205b764ebda2f49db359135243797911afd012afdecddd13dde900c70ce58638

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.8 KB

Download View at source

Reporting entityWomen's Care of Somerset

Victim entityWomen's Care of Somerset

Incidentdiscovered Feb 3, 2017

Stated responseSanctioned the office manager

ComplianceHIPAA individual notice OK

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing