DisclosureLens
AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedPHIIdentity (basic)Government IDHealth (basic)MediumResolved

Massachusetts General Hospital

bd_c33c91ef4437ef8c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Feb 6, 2026

Filed

Mar 2, 2026

To disclose

24 days

Affected

Not disclosed

Confidence

65%
Full breach record for Massachusetts General Hospital →88 incidents on file

Massachusetts General Hospital notified a patient that on February 3, 2026, a workforce member inadvertently sent a document containing PHI (name, DOB, SSN, diagnosis) to the incorrect patient via Patient Gateway. The Privacy Office became aware on February 6, 2026. The hospital investigated, implemented preventive measures, and is offering 24 months of credit monitoring.

Massachusetts clock✓ MA AG ≤30d24 days discovery → filing

Incident timeline

undetected · 3 days
discovery → filing · 24 days

Feb 3, 2026

Begins

Feb 6, 2026

Discovered

Mar 2, 2026

Filed

vs. sector median

9 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.