AccidentalHealthcareHealthcareMisconfigurationCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowResolved

University of Washington

bd_d6512ec60a11cad6 · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 26, 2018

Filed

Feb 20, 2019

To disclose

8 weeks

Affected

Not disclosed

Linked

5 filings

Confidence

65%

Full breach record for University of Washington →7 incidents on file

UW Medicine disclosed a data breach involving protected health information (PHI) due to a database configuration error. The error made internal reporting files containing names, medical record numbers, and descriptions of reported health information available on the internet between December 4, 2018, and January 10, 2019. UW Medicine became aware of the issue on December 26, 2018, and immediately removed the files. No medical records, financial information, or Social Security numbers were exposed. The incident was reported to the Office for Civil Rights.

J jump to incidentP pin to compareR raw source

California clockDiscovered Dec 26, 2018 → Notified Feb 19, 201955d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

undetected · 22 days

discovery → filing · 8 weeks / 56 days

Dec 4, 2018

Begins

Dec 26, 2018

Discovered

Feb 20, 2019

Filed

vs. sector median

3 wks faster

This filing is one of 5 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (4) · sorted by filing gap

Montana State AGbd_3adad2f84e312d482019-02-20Verified by operator
Washington State AGbd_4ecc99dad6670eb72019-02-20Verified
HHS OCRbd_721496fd43b47b112019-02-20Verified by operator
Oregon State AGbd_0968762279005b792019-02-25 · +5dCandidate

Name: University of Washington
norm: university of washington
Domain: uwmedicine.org

Name: University of Washington
norm: university of washington
Domain: uwmedicine.org
Industry: Healthcarellm

Discovered: Dec 26, 2018
Breach occurred: Dec 4, 2018 – Jan 10, 2019
Undetected for: 22 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 19, 2019
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Misconfiguration
Regulator citations: Reported this incident to the Office for Civil Rights

During the incident: Removed the information permanently from the internet
Reported this incident to the Office for Civil Rights
Changes made: Reviewing our internal protocols and procedures to prevent this from happening again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(56 days from discovery to filing)
Compliance flags: CA 60-day OK · 55d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Dec 26, 2018
→ Notified: Feb 19, 2019
55d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Dec 26, 2018 → Notified: Feb 19, 2019	55d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 5 filings · 4 states

View merged incident ↗

Montana State AGFeb 20 · first

Washington State AGFeb 20 · first

HHS OCRFeb 20 · first

California State AGFeb 20 · first · this page

Oregon State AG+5d

Pattern: first filing Feb 20 (MT), last Feb 25 (OR) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-144877
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 20, 2019
Raw hash: 47a190cd3df662b93fcad7fbdb04891d11906f3c6029fc2deb62b836380e3fea

Linked disclosures

Regulatory filings (4) · sorted by filing gap

Reporting entityUniversity of Washington

Victim entityUniversity of Washington

Incidentdiscovered Dec 26, 2018

Stated responseRemoved the information permanently from the internet

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov