CALIFORNIAPhysicalHealthcareHealthcareTheftBusiness Associate (HIPAA)Customer Data InvolvedHEALTH_BASICIDENTITY_BASICLowResolved

Office of Dr. David Elbaum

bd_d4a52128676cdb98 · schema v1 · pii pii-v1

Full breach record for Office of Dr. David Elbaum →

On November 10, 2016, the Office of Dr. David Elbaum (CA) discovered that paper copies of patients' PHI had been stolen from a third-party storage facility operated by a business associate. The exact date of theft is unknown. The breach affected approximately 500 individuals and included clinical and demographic information. The CE notified HHS, affected individuals, and the media; established a toll-free call center; and offered free credit monitoring. The BA implemented additional physical safeguards and OCR obtained assurances of corrective action. Submitted to HHS on 2017-01-09.

HIPAA clock✓ HHS notified9 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed500 affectedView incident

Source provenance

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Jan 9, 2017
Raw hash: 7d1f959d653781cc2b943ddbc07742793c6465b746276c2012b11ed8adae448b

Source filing

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.7 KB

Download View at source

Reporting entity

Name: Office of Dr. David Elbaum
norm: office of dr david elbaum
Industry: Health Care Services

Victim entity

Name: Office of Dr. David Elbaum
norm: office of dr david elbaum
Industry: Health Care Services
Industry: Healthcaresource default

Incident

Discovered: Nov 10, 2016
Materiality determined: —
Notification sent: —
Affected individuals: 500
Data types: HEALTH_BASICIDENTITY_BASIC
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Threat actor: External
Regulator citations: OCR obtained assurances that the CE implemented corrective actions

Compliance

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: HHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Nov 10, 2016
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Nov 10, 2016 → Notified: not extracted	—	regulatory submission	HHS notified

Extraction provenance

Status: No extraction artifact recorded for this disclosure.