KENTUCKYAccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedHealth (basic)Identity (basic)LowResolved

Summit Medical Group, Inc.

bd_c123bba0c60666c9 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jul 12, 2016

Filed

Aug 23, 2016

To disclose

6 weeks

Affected

674

Confidence

97%

Full breach record for Summit Medical Group, Inc. →2 incidents on file

Summit Medical Group, Inc. dba St. Elizabeth Physicians (KY) reported to HHS on 2016-08-23 an Unauthorized Access/Disclosure affecting 674 individuals. On July 12, 2016, a Weight Management Center employee sent a mass email about a vitamin presentation without blind-copying recipients, exposing all recipient email addresses. The CE adjusted emailing procedures, sanctioned the employee, and provided workforce training. OCR investigated and obtained assurances of corrective action. Breached information located in Email.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jul 12, 2016 → Notified Aug 23, 201642d ✓ HHS report on time6 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 6 weeks / 42 days

Jul 12, 2016

Begins

Jul 12, 2016

Discovered

Aug 23, 2016

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed674 affectedView incident

Name: Summit Medical Group, Inc.
norm: summit medical
Industry: Health Care Services

Name: Summit Medical Group, Inc.
norm: summit medical
Industry: Health Care Services
Also named: Summit Medical Group, Inc.dba oflegal entity
St. Elizabeth Physiciansdba oftrade name
Industry: Healthcaresource default

Discovered: Jul 12, 2016
Breach occurred: Jul 12, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Aug 23, 2016
Affected individuals: 674nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Email
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
Threat actor: Internal
Regulator citations: HHS OCR investigation; OCR obtained assurances of corrective action implementation
Initial access: insider_action

During the incident: Reviewed and adjusted emailing procedures
Sanctioned the WMC employee responsible for the breach
Provided training to leadership and WMC workforce
Employee who sent the email enrolled in multi-session individual training program
Changes made: Updated email BCC procedures
Staff training and sanctions
OCR corrective action assurances obtained
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 6 weeks(42 days from discovery to filing)
Compliance flags: HHS report on time · 42dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jul 12, 2016
→ Notified: Aug 23, 2016
42d 60 days HHS report on time
HIPAA
Discovered: Jul 12, 2016
→ Notified: Aug 23, 2016
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jul 12, 2016 → Notified: Aug 23, 2016	42d	60 days	HHS report on time
HIPAA	Discovered: Jul 12, 2016 → Notified: Aug 23, 2016	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Aug 23, 2016
Raw hash: e596688205bf95a63e4c8fe8e54017f17dbc76605802c937c7e53409d018dab6

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.0 KB

Download View at source

Reporting entitySummit Medical Group, Inc.

Victim entitySummit Medical Group, Inc.

Incidentdiscovered Jul 12, 2016

Stated responseReviewed and adjusted emailing procedures

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing