PENNSYLVANIAMisuseHealthcareHealthcareMisuse OtherData MishandlingCustomer Data InvolvedEmployee Data InvolvedHealth (basic)Identity (basic)MediumResolved

Penn State Milton S. Hershey Medical Center

bd_d022887c458350db · schema v1 · pii pii-v1

Severity

Medium

Discovered

—

Filed

Jun 6, 2014

To disclose

—

Affected

1,801

Confidence

95%

Full breach record for Penn State Milton S. Hershey Medical Center →

Penn State Milton S. Hershey Medical Center (PA) reported to HHS OCR on 2014-06-06 an Unauthorized Access/Disclosure affecting 1,801 individuals. An employee downloaded PHI onto an unsecured flash drive, used it on a personal computer, and emailed the work via a personal email account. Breached information was located on Email and Other Portable Electronic Device. PHI included demographic and clinical information. OCR investigated; CE updated encryption measures, reinforced staff policies, and obtained assurances of corrective action.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS notified

⚠ no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.

⚠ No discovery dateThe OCR public portal omits the discovery date, so the 60-day notification clock cannot be evaluated from this source — only that the filing was submitted.

Incident timeline — partial

? — ?

Breach window unknown

Jun 6, 2014

Filed

—

No filing yet · watching

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,801 affectedView incident

Name: Penn State Milton S. Hershey Medical Center
norm: penn state milton s hershey medical center
Industry: Health Care Services

Name: Penn State Milton S. Hershey Medical Center
norm: penn state milton s hershey medical center
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: Not extracted — the OCR public portal omits it
Materiality determined: —
Notification sent: —
Affected individuals: 1,801nationwide
Data types: Health (basic)Identity (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: EmailPortable electronic device
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical MediumT1048 Exfiltration Over Alternative Protocol
Threat actor: Internal
Regulator citations: HHS OCR investigation; CE submitted policies on personal device use, PHI storage on third-party media, and approved electronic connections; OCR verified policy was in place; OCR obtained assurances of corrective actions.
Initial access: insider_action

During the incident: Performed a risk assessment
Updated encryption measures
Reminded all clinical laboratory staff and faculty of expected PHI safeguarding practices
Provided staff with relevant policies on encryption and electronic messaging
Submitted policies to OCR regarding use of personal devices and emails, storing PHI on third-party media, and use of approved electronic connections
Changes made: Updated encryption measures
Reinforced PHI safeguarding policies for clinical laboratory staff
Policy review and reissuance covering personal device use and electronic messaging
Source: Quoted from the filing itself, not independently verified.

Compliance flags: HHS notified
Discovery-date grounding: no discovery dateNo discovery date was extracted, so no notification clock can be evaluated.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: not extracted
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: not extracted → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jun 6, 2014
Raw hash: b1b067c6c501a1513873d1bb901aeaad5a452e1a437ba304d768d172046c947e

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.3 KB

Download View at source

Reporting entityPenn State Milton S. Hershey Medical Center

Victim entityPenn State Milton S. Hershey Medical Center

IncidentUnauthorized Access

Stated responsePerformed a risk assessment

ComplianceHHS notified

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing