PhysicalHealthcareHealthcareLossCustomer Data InvolvedPHIGovernment IDIdentity (basic)Health (basic)MediumContained

Integris Baptist Medical Center, Inc.

bd_bd3af2101f2ac131 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Oct 17, 2019

Filed

Sep 8, 2020

To disclose

47 weeks

Affected

14state residents only

Linked

4 filings

Confidence

67%

Full breach record for Integris Baptist Medical Center, Inc. →3 incidents on file

INTEGRIS Baptist Medical Center, Inc. reported the loss of a portable hard drive containing patient information during an on-campus office move. The drive was discovered missing on October 17, 2019. A backup copy was located and reviewed, confirming that the missing drive contained the names, Social Security numbers, and limited clinical information of 14 New Hampshire residents. No evidence of misuse was found. The organization notified affected individuals and the NH Attorney General in September 2020, offering one year of credit monitoring.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 47 weeks / 327 days

Oct 17, 2019

Discovered

Sep 8, 2020

Filed

vs. sector median

+34 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Oregon State AGbd_66105fc3a25b54942020-09-04 · +4dVerified
California State AGbd_8502a69b9a932e0f2020-09-04 · +4dVerified
Montana State AGbd_7dd04b5672fa265b2020-05-29 · +102dCandidate

Name: INTEGRIS Baptist Medical Center, Inc.
norm: integris baptist medical center

Name: Integris Baptist Medical Center, Inc.
norm: integris baptist medical center
Industry: Healthcarellm

Discovered: Oct 17, 2019
Materiality determined: —
Notification sent: Sep 4, 2020
Affected individuals: 14state-resident count only
Data types: PHIGovernment IDIdentity (basic)Health (basic)
Data elements: Social Security numberMedical information
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Notified New Hampshire Office of the Attorney General

During the incident: Immediately began an investigation and conducted a thorough search to locate the hard drive
Located a backup copy of the hard drive
Conducted a comprehensive review of the entire contents of the backup hard drive
Began mailing notification letters to the New Hampshire residents
Offering eligible individuals a complimentary, one-year membership to credit monitoring and identity theft prevention services
Established a dedicated call center where all individuals may obtain more information regarding the incident
Changes made: Secured or destroyed similar hard drives
Provided additional education to staff on its policies regarding portable hard drives and securing patient information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 47 weeks(327 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGMay 29 · first

Oregon State AG+98d

California State AG+98d

New Hampshire State AG+102d · this page

Pattern: first filing May 29 (MT), last Sep 8 (NH) — a 102-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/integris-baptist-medical-center-20200908.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 8, 2020
Raw hash: 5793a4190d342f63e86c97ba21e56abe3cc378d0527ad7c629cffdeb0c25ed78

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityINTEGRIS Baptist Medical Center, Inc.

Victim entityIntegris Baptist Medical Center, Inc.

Incidentdiscovered Oct 17, 2019

Stated responseImmediately began an investigation and conducted a thorough search to locate the hard drive

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov