MisuseHealthcareHealthcarePrivilege AbuseCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Pedes Orange County, Inc.

bd_e0bd32b0ea24443c · schema v1 · pii pii-v1

Severity

Low

Discovered

Nov 14, 2017

Filed

Jan 12, 2018

To disclose

8 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Pedes Orange County, Inc. →

Pedes Orange County, Inc. disclosed that on November 14, 2017, a physician from another medical group sharing the same facility accessed the company's electronic medical records database without permission and disclosed materials to their attorney. The breach involved personal health information including names, diagnoses, treatments, and dates of service. Social Security numbers and financial account information were not involved. The company worked with the unauthorized individual to destroy the accessed information and is evaluating security protocols.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 59 days

Nov 14, 2017

Begins

Nov 14, 2017

Discovered

Jan 12, 2018

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_e5b62ee33028c5b32018-01-12Verified

Name: Pedes Orange County, Inc.
norm: pedes orange county

Name: Pedes Orange County, Inc.
norm: pedes orange county
Industry: Healthcarellm

Discovered: Nov 14, 2017
Breach occurred: Nov 14, 2017
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Insider
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: Partner
Initial access: trusted_relationship

During the incident: Working with the unauthorized individual to destroy all patient medical information that was accessed without permission
Evaluating existing security protocols to ensure an incident like this does not happen again
Changes made: Evaluating existing security protocols to ensure an incident like this does not happen again
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRJan 12 · first

California State AGJan 12 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-132631
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 12, 2018
Raw hash: e3f6cfa5d854ec3154f6eb40604ae61ef94b78e86744e2f8bd069b2021df1845

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityPedes Orange County, Inc.

Victim entityPedes Orange County, Inc.

Incidentdiscovered Nov 14, 2017

Stated responseWorking with the unauthorized individual to destroy all patient medical information that was accessed without permission

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov