Hill Country Memorial Hospital
bd_c40bc5f8a50314ea · schema v1 · pii pii-v1
Full breach record for Hill Country Memorial Hospital →Hill Country Memorial Hospital (TX) reported to HHS on 2017-04-21 a Hacking/IT Incident affecting 8,449 individuals. On February 21, 2017, a workforce member responded to a phishing email and provided credentials, enabling an unknown external actor to access her email account and send fraudulent invoices. Breached PHI on Email servers may have included names, addresses, dates of birth, Social Security numbers, and medical information. The CE notified HHS, affected individuals, and media, and implemented security awareness training and email controls. OCR obtained assurances of corrective action.
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_fc45e4cb92fd18b5Montana State AGfiled 2017-04-25(4d gap)Candidate
Source provenance
- Source URL
- https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
- Filed at
- Apr 21, 2017
- Raw hash
- da47f8176124dd956a198e31ca3c00986b33e7bca396db6967834681cc65724f
Source filing
Reporting entity
- Name
- Hill Country Memorial Hospitalnorm: hill country memorial hospital
- Industry
- Health Care Services
Victim entity
- Name
- Hill Country Memorial Hospitalnorm: hill country memorial hospital
- Industry
- Health Care Services
- Industry
- Healthcaresource default
Incident
- Discovered
- Feb 21, 2017
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- 8,449
- Data types
- HEALTH_BASICIDENTITY_BASICIDENTITY_GOVERNMENT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1566 PhishingT1078 Valid Accounts
- Threat actor
- ExternalFinancial
- Regulator citations
- HHS OCR – breach notification submitted; OCR obtained assurances of corrective action implementation
- Initial access
- phishing_link
Compliance
- Time to disclose
- 8 weeks(59 days from discovery to filing)
- Compliance flags
- HHS notified
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
- Clock breakdown
Statute Window Elapsed Threshold Status HIPAA Discovered: Feb 21, 2017→ Notified: not extracted— regulatory submission HHS notified
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.