ILLINOISPhysicalHealthcareHealthcareTheftCustomer Data InvolvedHealth (basic)Identity (basic)Government IDFinancial accountMediumResolved

Advocate Health Care Network

bd_af233c4f87dd9f88 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 24, 2009

Filed

Jan 22, 2010

To disclose

8 weeks

Affected

812

Confidence

97%

Full breach record for Advocate Health Care Network →3 incidents on file

Advocate Health Care (IL) reported to HHS OCR on 2010-01-22 a Theft affecting 812 individuals. On November 24, 2009, an Advocate nurse's laptop was stolen, containing PHI including names, addresses, dates of birth, Social Security numbers, insurance information, medications, and diagnoses. Breached information was located on a Laptop. No business associate was involved. Following the breach, Advocate revised mobile device security policies and OCR required workforce mobile-device users to submit acknowledgment forms.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time8 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 8 weeks / 59 days

Nov 24, 2009

Begins

Nov 24, 2009

Discovered

Jan 22, 2010

Filed

vs. sector median

3 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed812 affectedView incident

Name: Advocate Health Care Network
norm: advocate health care network
Industry: Health Care Services

Name: Advocate Health Care Network
norm: advocate health care network
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Nov 24, 2009
Breach occurred: Nov 24, 2009
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: 812nationwide
Data types: Health (basic)Identity (basic)Government IDFinancial account
HHS breach type: Theft
Where the data lived: Laptop
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: HHS OCR investigation

During the incident: Addressed mobile device security and acceptable use policy
OCR investigation resulted in workforce members using mobile devices being required to submit acknowledgment forms establishing administrative, technical, and physical safeguards
Changes made: Mobile device security policy updated
Mandatory acknowledgment forms for mobile device users introduced
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Nov 24, 2009
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Nov 24, 2009
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Nov 24, 2009 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Nov 24, 2009 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jan 22, 2010
Raw hash: 925e729136439e32e7bbd368c236a8d3d9c735bf363ad1d1d09545cc6dc26392

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.6 KB

Download View at source

Reporting entityAdvocate Health Care Network

Victim entityAdvocate Health Care Network

Incidentdiscovered Nov 24, 2009

Stated responseAddressed mobile device security and acceptable use policy

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing