CALIFORNIAMisuseHealthcareHealthcarePrivilege AbuseCustomer Data InvolvedPHIHealth (basic)Identity (basic)Government IDMediumContained

California Pacific Medical Center

bd_9cfedf44e9c501fe · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 15, 2014

Filed

Jan 23, 2015

To disclose

14 weeks

Affected

845

Linked

2 filings

Confidence

66%

Full breach record for California Pacific Medical Center →

California Pacific Medical Center reported to HHS on 2015-01-23 a Unauthorized Access/Disclosure affecting 845 individuals. Breached information located on Electronic Medical Record. A pharmacy department workforce member impermissibly accessed the medical records of 845 individuals between October 2013 and October 2014.

J jump to incidentP pin to compareR raw source

HIPAA clock✗ HHS report late14 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 379 days

discovery → filing · 14 weeks / 100 days

Oct 1, 2013

Begins

Oct 15, 2014

Discovered

Jan 23, 2015

Filed

vs. sector median

+5 wks slower

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

California State AGbd_59a42b43d70adf9e2015-01-23Verified

Name: California Pacific Medical Center
norm: california pacific medical center
Industry: Health Care Services

Name: California Pacific Medical Center
norm: california pacific medical center
Industry: Healthcaresource default

Discovered: Oct 15, 2014
Breach occurred: Oct 1, 2013 – Oct 15, 2014
Undetected for: 379 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 845nationwide
Data types: PHIHealth (basic)Identity (basic)Government ID
HHS breach type: Unauthorized access or disclosure
Where the data lived: Electronic medical record
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Initial access: insider_action

During the incident: Applied employee sanctions pursuant to its policy and procedure
Provided breach notification to HHS, affected individuals, and the media
Retrained employees on relevant HIPAA policies and procedures
Changes made: Retrained employees on relevant HIPAA policies and procedures
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 weeks(100 days from discovery to filing)
Compliance flags: HHS report lateHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Oct 15, 2014
→ Notified: not extracted
— 60 days HHS report late
HIPAA
Discovered: Oct 15, 2014
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Oct 15, 2014 → Notified: not extracted	—	60 days	HHS report late
HIPAA	Discovered: Oct 15, 2014 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

California State AGJan 23 · first

HHS OCRJan 23 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jan 23, 2015
Raw hash: 22f63441254b40fd2b92e0ea5065687b20dd6c45d9ea681a0f0a385ba9ec472e

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.9 KB

Download View at source

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCalifornia Pacific Medical Center

Victim entityCalifornia Pacific Medical Center

Incidentdiscovered Oct 15, 2014

Stated responseApplied employee sanctions pursuant to its policy and procedure

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing