ALABAMAPhysicalHealthcareHealthcareTheftBusiness Associate (HIPAA)Customer Data InvolvedIdentity (basic)Government IDHealth (basic)Financial accountHighResolved

Surgical Care Affiliates, Inc.

bd_e00b8da86cdf8996 · schema v1 · pii pii-v1

Severity

High

Discovered

Mar 17, 2016

Filed

May 16, 2016

To disclose

9 weeks

Affected

9,009

Confidence

66%

Full breach record for Surgical Care Affiliates, Inc. →

Surgical Care Affiliates reported to HHS on 2016-05-16 a Theft affecting 9009 individuals. Breached information located on Laptop. A laptop containing cached Outlook emails with PII and PHI was stolen from an employee's home.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Mar 17, 2016 → Notified May 16, 201660d ✓ HHS report on time9 weeks discovery → filing

⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.

Incident timeline

discovery → filing · 9 weeks / 60 days

Mar 17, 2016

Begins

Mar 17, 2016

Discovered

May 16, 2016

Filed

vs. sector median

2 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed9,009 affectedView incident

Name: Surgical Care Affiliates, Inc.
norm: surgical care affiliates
Industry: Health Care Services

Name: Surgical Care Affiliates, Inc.
norm: surgical care affiliates
Industry: Healthcaresource default

Discovered: Mar 17, 2016
Breach occurred: Mar 17, 2016
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 16, 2016
Affected individuals: 9,009nationwide
Data types: Identity (basic)Government IDHealth (basic)Financial account
HHS breach type: Theft
Where the data lived: Laptop
Covered-entity type: Business associate
Attack vector: Unauthorized Access
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Third party: via Surgical Care Affiliatesbusiness associate

During the incident: Opened an internal investigation
Retrained the employee involved to reinforce its existing HIPAA policies pertaining to the safeguarding of electronic devices and password management
Provided free credit monitoring to the affected individuals whose social security numbers may have been exposed
Provided timely breach notification to HHS, to affected individuals, on its website, and to the media
Changes made: Retrained the employee involved to reinforce its existing HIPAA policies pertaining to the safeguarding of electronic devices and password management
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 9 weeks(60 days from discovery to filing)
Compliance flags: HHS report on time · 60dHHS notified
Discovery-date grounding: occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Mar 17, 2016
→ Notified: May 16, 2016
60d 60 days HHS report on time
HIPAA
Discovered: Mar 17, 2016
→ Notified: May 16, 2016
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Mar 17, 2016 → Notified: May 16, 2016	60d	60 days	HHS report on time
HIPAA	Discovered: Mar 17, 2016 → Notified: May 16, 2016	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: May 16, 2016
Raw hash: 630dbaa215e74cf5d4b7c6260642779a2c52d8c2b9d211b1f6e10b8b0caee9ab

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.1 KB

Download View at source

Reporting entitySurgical Care Affiliates, Inc.

Victim entitySurgical Care Affiliates, Inc.

Incidentdiscovered Mar 17, 2016

Stated responseOpened an internal investigation

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing