ARIZONAAccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedIdentity (basic)Financial accountLowResolved

Southwestern Eye Center

bd_c6b80ba58d4fa106 · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Aug 1, 2018

To disclose

—

Affected

667

Confidence

96%

Full breach record for Southwestern Eye Center →

Southwestern Eye Center (AZ) reported to HHS on August 1, 2018 an Unauthorized Access/Disclosure affecting 667 individuals. During a mass mailing of patient refund checks in April 2018, the CE's business associate used an electronic mail merge that mixed up patient names and addresses on paper refund checks. Breached information included demographic data. The CE re-issued checks, terminated the BA contract, implemented auditing controls, and revised its mailing validation procedure.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline

Apr 1, 2018

Begins

Aug 1, 2018

Filed

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed667 affectedView incident

Name: Southwestern Eye Center
norm: southwestern eye center
Industry: Health Care Services

Name: Southwestern Eye Center
norm: southwestern eye center
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Breach occurred: Apr 1, 2018 – Apr 30, 2018
Materiality determined: —
Notification sent: Aug 1, 2018
Affected individuals: 667nationwide
Data types: Identity (basic)Financial account
HHS breach type: Unauthorized access or disclosure
Where the data lived: Paper / films
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
Threat actor: Partner
Regulator citations: HHS OCR notified; OCR obtained corrective action assurances

During the incident: Re-issued and re-sent patient refund checks correctly
Terminated contract with business associate responsible for the mail merge error
Implemented random auditing of patient demographics on pending patient refund checks
Revised procedure so accounting department reviews and validates patient refund checks prior to mailing
Provided breach notification to HHS, affected individuals, and the media
Changes made: Re-issued and re-sent patient refund checks correctly
Terminated contract with business associate responsible for the mail merge error
Implemented random auditing of patient demographics on pending patient refund checks
Revised procedure so accounting department reviews and validates patient refund checks prior to mailing
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: Aug 1, 2018
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: Aug 1, 2018	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Aug 1, 2018
Raw hash: 3256eb0ece8c979ce179b4aecfa2a3b46b5a3faa07c8a4d148821db31f6228d8

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.7 KB

Download View at source

Reporting entitySouthwestern Eye Center

Victim entitySouthwestern Eye Center

IncidentUnauthorized Access

Stated responseRe-issued and re-sent patient refund checks correctly

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing