TEXASHackingHealthcareHealthcareCustomer Data InvolvedData ExfiltratedPHIHealth (basic)Identity (basic)Financial accountMediumResolved

Patients Choice

bd_d845ce1328b3c68f · schema v1 · pii pii-v1

Severity

Medium

Discovered

Nov 19, 2016

Filed

Sep 26, 2017

To disclose

44 weeks

Affected

1,069

Confidence

66%

Full breach record for Patients Choice →

Patients Choice reported to HHS on 2017-09-26 a Hacking/IT Incident affecting 1069 individuals. Breached information located on Network Server. An individual hacked into the CE's FTP server on November 19, 2016, stealing demographic, financial, and clinical PHI. The CE implemented encryption, firewall protection, and updated security policies.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Nov 19, 2016 → Notified Sep 26, 2017311d ✗ HHS report late44 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 44 weeks / 311 days

Nov 19, 2016

Begins

Nov 19, 2016

Discovered

Sep 26, 2017

Filed

vs. sector median

+32 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1,069 affectedView incident

Name: Patients Choice
norm: patients choice
Industry: Health Care Services

Name: Patients Choice
norm: patients choice
Industry: Healthcaresource default

Discovered: Nov 19, 2016
Breach occurred: Nov 19, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 26, 2017
Affected individuals: 1,069nationwide
Data types: PHIHealth (basic)Identity (basic)Financial account
HHS breach type: Hacking / IT incident
Where the data lived: Network server
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified HHS OCROCR obtained assurances that the CE implemented these corrective actions
Initial access: exploit_public_facing

During the incident: Implemented additional technical safeguards, including encryption and firewall protection
Stopped using FTP servers
Updated its Privacy and Security policies and procedures
Conducted an updated risk analysis
Implemented a corresponding risk management plan
Changes made: Implemented additional technical safeguards, including encryption and firewall protection
Stopped using FTP servers
Updated its Privacy and Security policies and procedures
Conducted an updated risk analysis
Implemented a corresponding risk management plan
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 44 weeks(311 days from discovery to filing)
Compliance flags: HHS report late · 311dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Nov 19, 2016
→ Notified: Sep 26, 2017
311d 60 days HHS report late
HIPAA
Discovered: Nov 19, 2016
→ Notified: Sep 26, 2017
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Nov 19, 2016 → Notified: Sep 26, 2017	311d	60 days	HHS report late
HIPAA	Discovered: Nov 19, 2016 → Notified: Sep 26, 2017	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Sep 26, 2017
Raw hash: c50097fe37b642ffc7cdadc19470ff4c68ebf7417adc213755c97df43a7701f0

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html1.7 KB

Download View at source

Reporting entityPatients Choice

Victim entityPatients Choice

Incidentdiscovered Nov 19, 2016

Stated responseImplemented additional technical safeguards, including encryption and firewall protection

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing