MARYLANDMisuseHealthcareHealthcarePrivilege AbuseCustomer Data InvolvedPHIHealth (basic)Identity (basic)MediumResolved

Heart Center of Southern Maryland, L.L.P.

bd_c0eefb82d6a4862a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 7, 2016

Filed

Jul 7, 2016

To disclose

4 weeks

Affected

1,350

Confidence

66%

Full breach record for Heart Center of Southern Maryland, L.L.P. →

Heart Center of Southern Maryland, L.L.P. reported to HHS on 2016-07-07 a Hacking/IT Incident affecting 1350 individuals. Breached information located on Electronic Medical Record. A rogue staff member copied patient profile information and permitted a third party to access her computer, disclosing PHI of 1,350 individuals treated by a departing physician.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jun 7, 2016 → Notified Jul 7, 201630d ✓ HHS report on time4 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 5 days

discovery → filing · 4 weeks / 30 days

Jun 2, 2016

Begins

Jun 7, 2016

Discovered

Jul 7, 2016

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,350 affectedView incident

Name: Heart Center of Southern Maryland, L.L.P.
norm: heart center of southern maryland
Industry: Health Care Services

Name: Heart Center of Southern Maryland, L.L.P.
norm: heart center of southern maryland
Industry: Healthcaresource default

Discovered: Jun 7, 2016
Breach occurred: Jun 2, 2016 – Jun 7, 2016
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 7, 2016
Affected individuals: 1,350nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Hacking / IT incident
Where the data lived: Electronic medical record
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Internal
Regulator citations: Notified HHSOCR obtained the CE’s Security Rule policies and procedures
Initial access: insider_action

During the incident: Provided breach notification to HHS
Provided breach notification to affected individuals
Provided breach notification to the media
Changes made: Confirmed that the CE provided employee training
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 4 weeks(30 days from discovery to filing)
Compliance flags: HHS report on time · 30dHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jun 7, 2016
→ Notified: Jul 7, 2016
30d 60 days HHS report on time
HIPAA
Discovered: Jun 7, 2016
→ Notified: Jul 7, 2016
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jun 7, 2016 → Notified: Jul 7, 2016	30d	60 days	HHS report on time
HIPAA	Discovered: Jun 7, 2016 → Notified: Jul 7, 2016	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jul 7, 2016
Raw hash: a59b06a81d523ecc77dc6113c210f7bbd621e2b929121dc2bb27da47adc3e26e

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.7 KB

Download View at source

Reporting entityHeart Center of Southern Maryland, L.L.P.

Victim entityHeart Center of Southern Maryland, L.L.P.

Incidentdiscovered Jun 7, 2016

Stated responseProvided breach notification to HHS

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing