MisuseHealthcareHealthcarePrivilege AbuseEmployee Data InvolvedTargetedPHIHealth (basic)Identity (basic)Government IDMediumActive

Kennewick Public Hospital District

bd_9c9197a11b669d0f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Mar 14, 2017

Filed

May 26, 2017

To disclose

10 weeks

Affected

569state residents only

Linked

2 filings

Confidence

68%

Full breach record for Kennewick Public Hospital District →

Kennewick Public Hospital District (dba Trios Health) reported an insider breach where a former employee impermissibly accessed patient EHR records between Oct 2013 and Mar 2017. Discovered Mar 14, 2017, the incident affected 569 individuals, exposing PHI, demographics, SSNs, and driver's licenses. The employee was terminated. The organization offered 1 year of identity theft protection and enhanced privacy training.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1238 days

discovery → filing · 10 weeks / 73 days

Oct 23, 2013

Begins

Mar 14, 2017

Discovered

May 26, 2017

Filed

vs. sector median

2 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_9c386cb88b7c1bbe2017-05-18 · +8dVerified

Name: Kennewick Public Hospital District
norm: kennewick public hospital district
Domain: trioshealth.org
Industry: Healthcare Provider

Name: Kennewick Public Hospital District
norm: kennewick public hospital district
Domain: trioshealth.org
Industry: Healthcare Provider
Also named: Kennewick Public Hospital Districtdba oflegal entity
Trios Healthdba oftrade name
Industry: Healthcarellm

Discovered: Mar 14, 2017
Breach occurred: Oct 23, 2013 – Mar 31, 2017
Undetected for: 1,238 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 29, 2017
Affected individuals: 569state-resident count only
Data types: PHIHealth (basic)Identity (basic)Government ID
Data elements: NameMedical informationSocial Security numberDate of birth
WA-stated cause: Unauthorized Access
WA-stated duration: lifecycle 500+dexposure 500+d
WA-stated discovery: Found after the fact
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified U.S. Office for Civil Rights at the Department of Health and Human ServicesNotified the Washington State Attorney General
Initial access: insider_action

During the incident: Took disciplinary action against the employee including involuntary administrative leave, followed by termination
Limited EHR access by the individual
Restricted further EHR access permissions to all staff within the employee’s department
Notifying the media
Posting the incident on its website
Providing notification to appropriate regulatory agencies
Offering fee identity theft protection and advanced fraud monitoring services for one year at no cost
Changes made: Deploy additional privacy training to employees
Conduct security risk assessment
Audit privacy policies
Implement standard auditing processes
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(73 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRMay 18 · first

Washington State AG+8d · this page

Pattern: first filing May 18 (WA), last May 26 (WA) — a 8-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://agportal-s3bucket.s3.amazonaws.com/databreach/BreachM9708.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 26, 2017
Raw hash: e104fc49c84084a8e193c40f15cb796d61044ad6f262aaf7f883ff2d387eaa41

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityKennewick Public Hospital District

Victim entityKennewick Public Hospital District

Incidentdiscovered Mar 14, 2017

Stated responseTook disciplinary action against the employee including involuntary administrative leave, followed by termination

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceagportal-s3bucket.s3.amazonaws.com