CALIFORNIAPhysicalHealthcareHealthcareTheftCustomer Data InvolvedHealth (basic)Identity (basic)MediumResolved

Lancaster Cardiology Medical Group

bd_adc4f02b81f08cef · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 21, 2015

Filed

Aug 24, 2015

To disclose

9 weeks

Affected

1,200

Confidence

97%

Full breach record for Lancaster Cardiology Medical Group →

Lancaster Cardiology Medical Group and Sunder Heart Institute & Vascular Medical Clinic (Lancaster, CA) reported to HHS on 2015-08-24 a Theft affecting 1,200 individuals (per HHS portal; web description cites ~2,071). Between June 20–21, 2015, laptop computers, desktop computers, servers, and other portable electronic devices were stolen during a burglary. Breached ePHI included clinical and demographic information. The CE notified law enforcement, HHS, affected individuals, and media. Corrective actions included full ePHI encryption, new locks, improved video surveillance, and updated safeguard policies. OCR confirmed implementation.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 1 days

discovery → filing · 9 weeks / 64 days

Jun 20, 2015

Begins

Jun 21, 2015

Discovered

Aug 24, 2015

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,200 affectedView incident

Name: Lancaster Cardiology Medical Group
norm: lancaster cardiology medical
Industry: Health Care Services

Name: Lancaster Cardiology Medical Group
norm: lancaster cardiology medical
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Jun 21, 2015
Breach occurred: Jun 20, 2015 – Jun 21, 2015
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 1,200nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: Theft
Where the data lived: Desktop computerLaptopNetwork serverPortable electronic device
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: HHS OCR investigation; OCR obtained assurances of corrective action implementation

During the incident: Reported incident to law enforcement
Provided breach notification to HHS, affected individuals, and the media
Implemented plan to encrypt all ePHI stored on devices
Installed new locks and improved video surveillance
Updated policies and procedures for administrative, technical, and physical safeguards
Changes made: Full ePHI encryption on all devices
Enhanced physical security (new locks, improved video surveillance)
Updated administrative, technical, and physical safeguard policies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(64 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jun 21, 2015
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jun 21, 2015 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Aug 24, 2015
Raw hash: 6eaae60f1f80b2788a1b2a940ccd690881536017b63c85cfcaef400ed5e4ce17

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.2 KB

Download View at source

Reporting entityLancaster Cardiology Medical Group

Victim entityLancaster Cardiology Medical Group

Incidentdiscovered Jun 21, 2015

Stated responseReported incident to law enforcement

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing