OHPhysicalHealthcareHealthcareTheftCustomer Data InvolvedHEALTH_BASICIDENTITY_BASICLowResolved

Henry County Health Department

bd_a70cbd818ec5e1dd · schema v1 · pii pii-v1

Full breach record for Henry County Health Department →

Henry County Health Department (OH) reported to HHS on 2016-12-21 a Theft affecting 574 individuals. On October 22, 2016, a nurse's laptop and paper records were stolen from her car inside her locked garage. Demographic and clinical information was compromised. Breached information located on Electronic Medical Record, Email, Laptop, and Paper/Films. The CE notified HHS, individuals, and media, reprimanded the employee, encrypted all laptops/workstations/servers, issued off-premises laptop safeguarding policy, and updated Privacy and Security Policies. OCR obtained corrective action assurances.

HIPAA clock✓ HHS notified9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed574 affectedView incident

Source provenance

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Dec 21, 2016
Raw hash: f7d2c67b202e07110f4fbff852d02facee3da68c063519ed660176a3d73d2775

Source filing

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.7 KB

Download View at source

Reporting entity

Name: Henry County Health Department
norm: henry county health department
Industry: Health Care Services

Victim entity

Name: Henry County Health Department
norm: henry county health department
Industry: Health Care Services
Industry: Healthcaresource default

Incident

Discovered: Oct 22, 2016
Materiality determined: —
Notification sent: —
Affected individuals: 574
Data types: HEALTH_BASICIDENTITY_BASIC
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: OCR obtained documented assurances that the CE implemented the corrective action steps noted above.

Compliance

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Oct 22, 2016
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Oct 22, 2016 → Notified: not extracted	—	regulatory submission	HHS notified

Extraction provenance

Status: No extraction artifact recorded for this disclosure.