NORTH CAROLINAAccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedPHIHealth (basic)Identity (basic)Government IDHighResolved

UNC Health Care

bd_9ca56501bde1f58e · schema v1 · pii pii-v1

Severity

High

Discovered

Jan 26, 2017

Filed

Mar 20, 2017

To disclose

8 weeks

Affected

1,298

Confidence

66%

Full breach record for UNC Health Care →2 incidents on file

UNC Health Care reported to HHS on 2017-03-20 an Unauthorized Access/Disclosure affecting 1,298 individuals. Breached information located on Paper/Films. The entity's clinics improperly sent prenatal pregnancy home risk screening forms to local county health departments for patients not participating in Medicaid, exposing PHI including SSNs, medical diagnoses, and demographic data.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jan 26, 2017 → Notified Mar 20, 201753d ✓ HHS report on time8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1031 days

discovery → filing · 8 weeks / 53 days

Apr 1, 2014

Begins

Jan 26, 2017

Discovered

Mar 20, 2017

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,298 affectedView incident

Name: UNC Health Care
norm: unc health care
Domain: myuncchart.org
Industry: Health Care Services

Name: UNC Health Care
norm: unc health care
Domain: myuncchart.org
Industry: Healthcaresource default

Discovered: Jan 26, 2017
Breach occurred: Apr 1, 2014 – Feb 17, 2017
Undetected for: 1,031 daysoccurrence → discovery
Materiality determined: —
Notification sent: Mar 20, 2017
Affected individuals: 1,298nationwide
Data types: PHIHealth (basic)Identity (basic)Government ID
HHS breach type: Unauthorized access or disclosure
Where the data lived: Paper / films
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1530 Data from Cloud Storage
Threat actor: Internal
Regulator citations: Provided breach notification to HHSOCR obtained assurances that the CE implemented the corrective actions

During the incident: Provided breach notification to HHS, affected individuals, and the media
Posted substitute notice
Offered identity theft resolution services
Instructed clinics to stop having non-Medicaid beneficiaries complete screening forms
Purged files of non-Medicaid forms
Retrained staff on the new procedure
Changes made: Instructed clinics to stop having non-Medicaid beneficiaries complete screening forms
Purged files of non-Medicaid forms
Retrained staff on the new procedure
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: HHS report on time · 53dHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jan 26, 2017
→ Notified: Mar 20, 2017
53d 60 days HHS report on time
HIPAA
Discovered: Jan 26, 2017
→ Notified: Mar 20, 2017
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jan 26, 2017 → Notified: Mar 20, 2017	53d	60 days	HHS report on time
HIPAA	Discovered: Jan 26, 2017 → Notified: Mar 20, 2017	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Mar 20, 2017
Raw hash: 4c6c95b313ace64ad70bde8af0148032803dfe5e392f3c8d43dd7ef2e664b89a

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.1 KB

Download View at source

Reporting entityUNC Health Care

Victim entityUNC Health Care

Incidentdiscovered Jan 26, 2017

Stated responseProvided breach notification to HHS, affected individuals, and the media

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing