CALIFORNIAPhysicalHealthcareHealthcareTheftCustomer Data InvolvedHEALTH_BASICIDENTITY_BASICMediumResolved

Graybill Medical Group

bd_a8327c81ce5ed421 · schema v1 · pii pii-v1

Full breach record for Graybill Medical Group →

Graybill Medical Group (CA) reported to HHS on 2014-10-15 a Theft affecting 1,863 individuals. X-rays of poor quality placed in a trash container for destruction were mistakenly disposed of as regular trash by cleaning personnel on September 9, 2014, and taken to a landfill before they could be recovered. PHI exposed included patient names, addresses, dates of birth, physician/medical provider information, and possibly body images. Breached information located on Other (physical x-ray films). The CE notified HHS, affected individuals, and the media, offered credit monitoring, and implemented corrective safeguards. OCR obtained assurances of remediation.

HIPAA clock✓ HHS notified5 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,863 affectedView incident

Source provenance

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Oct 15, 2014
Raw hash: 26ad8de274af683de0120822252099735cb4e04ccf54fd8ead01054481f2ff2a

Source filing

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.0 KB

Download View at source

Reporting entity

Name: Graybill Medical Group
norm: graybill medical
Industry: Health Care Services

Victim entity

Name: Graybill Medical Group
norm: graybill medical
Industry: Health Care Services
Industry: Healthcaresource default

Incident

Discovered: Sep 9, 2014
Materiality determined: —
Notification sent: —
Affected individuals: 1,863
Data types: HEALTH_BASICIDENTITY_BASIC
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: Internal
Regulator citations: HHS OCR obtained assurances that corrective actions were implemented

Compliance

Time to disclose: 5 weeks(36 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Sep 9, 2014
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Sep 9, 2014 → Notified: not extracted	—	regulatory submission	HHS notified

Extraction provenance

Status: No extraction artifact recorded for this disclosure.