PhysicalHealthcareHealthcareTheftCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Health (basic)PHIMediumResolved

Pediatrix Cardiology of Washington, P.C.

bd_8deae6043e0928a9 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 7, 2021

Filed

Jun 4, 2021

To disclose

28 days

Affected

1,136state residents only

Linked

2 filings

Confidence

71%

Full breach record for Pediatrix Cardiology of Washington, P.C. →

Pediatrix Cardiology of Washington, P.C. d/b/a NorthWest Congenital Heart Care reported the theft of an external hard drive containing patient PHI and PII on May 7, 2021. 1,136 Washington residents were notified. No SSNs or financial data were involved. The drive backups were eliminated as a remediation step.

J jump to incidentP pin to compareR raw source

Washington clock✓ WA AG ≤30d28 days discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 28 days

May 7, 2021

Begins

May 7, 2021

Discovered

Jun 4, 2021

Filed

vs. sector median

9 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_b1beda9aa2d62fba2021-06-04Verified

Name: Alston & Bird LLP
norm: alston bird

Name: Pediatrix Cardiology of Washington, P.C.
norm: pediatrix cardiology of washington
Also named: Pediatrix Cardiology of Washington, P.C.dba oflegal entity
NorthWest Congenital Heart Caredba oftrade name
Industry: Healthcarellm

Discovered: May 7, 2021
Breach occurred: May 7, 2021
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 4, 2021
Affected individuals: 1,136state-resident count only
Data types: Identity (basic)Health (basic)PHI
Data elements: NameDate of birthHealth insurance IDMedical information
WA-stated cause: Theft or Mistake
WA-stated duration: lifecycle Unknowndexposure Unknownd
WA-stated discovery: Found after the fact
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: ExternalFinancial
Regulator citations: Notified the Office of the Washington Attorney General

During the incident: Contacted law enforcement
Began a review to determine what information may have been included on the external hard drive
Changes made: Enhance our security controls to minimize the risk of any similar event in the future
Eliminating external hard drive data backups
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 28 days(28 days from discovery to filing)
Compliance flags: WA AG ≤30d
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRJun 4 · first

Washington State AGJun 4 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM10480.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 4, 2021
Raw hash: 9e8c8240c9b02269573edfb81bc5f934cdbe21d0cab698f6c87721a37b5e1785

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityAlston & Bird LLP

Victim entityPediatrix Cardiology of Washington, P.C.

Incidentdiscovered May 7, 2021

Stated responseContacted law enforcement

ComplianceWA AG ≤30d

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com