WASHINGTONHackingHealthcareHealthcarePhishingStolen CredentialsCustomer Data InvolvedData ExfiltratedPHIHealth (basic)Identity (basic)Government IDHighContained

Northwest Surgical Specialists, P.C.

bd_e5220cf24de72802 · schema v1 · pii pii-v1

Severity

High

Discovered

May 22, 2018

Filed

Oct 5, 2018

To disclose

19 weeks

Affected

2,050

Linked

3 filings

Confidence

66%

Full breach record for Northwest Surgical Specialists, P.C. →

Northwest Surgical Specialists, P.C. reported to HHS on 2018-10-05 a Hacking/IT Incident affecting 2050 individuals. Breached information located on Email. An employee clicked a phishing link, compromising their account which contained PHI.

J jump to incidentP pin to compareR raw source

HIPAA clock✗ HHS report late19 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 13 days

discovery → filing · 19 weeks / 136 days

May 9, 2018

Begins

May 22, 2018

Discovered

Aug 8, 2018

Scope determined

Oct 5, 2018

Filed

vs. sector median

+8 wks slower

This filing is one of 3 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

Oregon State AGbd_88b0c6a9a86701002018-10-05Verified
Massachusetts State AGbd_9a55d2e2c2caa8582018-10-05Verified

Name: Northwest Surgical Specialists, P.C.
norm: northwest surgical specialists
Industry: Health Care Services

Name: Northwest Surgical Specialists, P.C.
norm: northwest surgical specialists
Industry: Health Care Services
Industry: Healthcaresource default

Discovered: May 22, 2018
Breach occurred: May 9, 2018
Undetected for: 13 daysoccurrence → discovery
Materiality determined: Aug 8, 2018
Notification sent: —
Affected individuals: 2,050nationwide
Data types: PHIHealth (basic)Identity (basic)Government ID
HHS breach type: Hacking / IT incident
Where the data lived: Email
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Regulator citations: OCR provided the CE with technical assistance regarding its security management process
Initial access: phishing_link

During the incident: Notified its IT department
Retained a computer forensic investigation firm
Reset the password on the compromised account
Disabled the rules that were created
Confirmed that no other email accounts were compromised
Provided breach notification to HHS, affected individuals, and the media, as well as substitute notice
Changes made: Created an alert for when a user creates automatic forwarding rules
Enabled two-factor authentication for all employees
Retrained employees on privacy and security requirements
Implemented a forced email password change policy
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 19 weeks(136 days from discovery to filing)
Compliance flags: HHS report lateHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: May 22, 2018
→ Notified: not extracted
— 60 days HHS report late
HIPAA
Discovered: May 22, 2018
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: May 22, 2018 → Notified: not extracted	—	60 days	HHS report late
HIPAA	Discovered: May 22, 2018 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

Oregon State AGOct 5 · first

Massachusetts State AGOct 5 · first

HHS OCROct 5 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Oct 5, 2018
Raw hash: 6298c9f9741ee07eba58dc07536c1e4ceb768a562f6d0717877a571106d1c0e5

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.5 KB

Download View at source

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityNorthwest Surgical Specialists, P.C.

Victim entityNorthwest Surgical Specialists, P.C.

Incidentdiscovered May 22, 2018

Stated responseNotified its IT department

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing