DISTRICT OF COLUMBIAAccidentalHealthcareHealthcareMisconfigurationBusiness Associate (HIPAA)Customer Data InvolvedDelayed DiscoveryHealth (basic)Identity (basic)MinorHighResolved

Children's National Medical Center

bd_bddfe486a7c93dde · schema v1 · pii pii-v1

Severity

High

Discovered

Dec 1, 2015

Filed

Apr 25, 2016

To disclose

21 weeks

Affected

4,107

Confidence

94%

Full breach record for Children's National Medical Center →3 incidents on file

Children's National Medical Center (DC) reported to HHS on 2016-04-25 an Unauthorized Access/Disclosure affecting 4,107 individuals. A former business associate, Ascend Health System, misconfigured an FTP site, potentially exposing transcription documents via the internet. Breached PHI included children's names, dates of birth, medications, and physicians' names. The breach was discovered in December 2015; the CE had ceased business with the BA on June 23, 2014. Notification was provided to HHS, affected individuals, and the media.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Dec 1, 2015 → Notified Apr 25, 2016146d ✗ HHS report late21 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 21 weeks / 146 days

Dec 1, 2015

Discovered

Apr 25, 2016

Filed

vs. sector median

+9 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed4,107 affectedView incident

Name: Children's National Medical Center
norm: children s national medical center
Domain: childrensnational.org
Industry: Health Care Services

Name: Children's National Medical Center
norm: children s national medical center
Domain: childrensnational.org
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Dec 1, 2015
Materiality determined: —
Notification sent: Apr 25, 2016
Affected individuals: 4,107nationwide
Data types: Health (basic)Identity (basic)Minor
HHS breach type: Unauthorized access or disclosure
Where the data lived: Network server
Covered-entity type: Healthcare providerBusiness associate involved
Attack vector: Misconfiguration
MITRE ATT&CK: T1190 Exploit Public-Facing Application
Threat actor: Partner
Regulator citations: OCR obtained copies of notification letters and BA agreement; CE provided assurances of corrective actions implemented.
Third party: via Ascend Health System

During the incident: Breach notification sent to HHS, affected individuals, and the media.
OCR obtained copies of notification letters and BA agreement.
CE implemented corrective actions per OCR assurances.
Changes made: Ceased business with Ascend Health System on June 23, 2014.
Implemented corrective actions as confirmed to OCR.
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 weeks(146 days from discovery to filing)
Compliance flags: HHS report late · 146dHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Dec 1, 2015
→ Notified: Apr 25, 2016
146d 60 days HHS report late
HIPAA
Discovered: Dec 1, 2015
→ Notified: Apr 25, 2016
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Dec 1, 2015 → Notified: Apr 25, 2016	146d	60 days	HHS report late
HIPAA	Discovered: Dec 1, 2015 → Notified: Apr 25, 2016	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Apr 25, 2016
Raw hash: 874c5b1b40c203f4e6f0df91ec482e2a8b212dc4a50cfc13e39a0ea5863240ad

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.8 KB

Download View at source

Reporting entityChildren's National Medical Center

Victim entityChildren's National Medical Center

Incidentdiscovered Dec 1, 2015

Stated responseBreach notification sent to HHS, affected individuals, and the media.

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing