PhysicalHealthcareHealthcareTheftCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Hoag Clinic

bd_e7b8343251919c03 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 5, 2020

Filed

Aug 3, 2020

To disclose

8 weeks

Affected

738

Linked

2 filings

Confidence

66%

Full breach record for Hoag Clinic →

Hoag Clinic reported the theft of a staff member's laptop from a vehicle in Newport Beach, CA, on June 5, 2020. The laptop contained protected health information (PHI) for 738 individuals, including names, addresses, medical record numbers, and treatment details. No evidence of data access or misuse was found. Hoag filed a police report, conducted an internal investigation, and offered one year of identity monitoring to affected patients.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 5, 2020 → Notified Jul 31, 202056d ✓ CA 60-day OK8 weeks discovery → filing

Incident timeline

discovery → filing · 8 weeks / 59 days

Jun 5, 2020

Begins

Jun 5, 2020

Discovered

Aug 3, 2020

Filed

vs. sector median

4 wks faster

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_8a5cf0aba27604332020-08-03Verified by operator

Name: Hoag Clinic
norm: hoag clinic

Name: Hoag Clinic
norm: hoag clinic
Industry: Healthcarellm

Discovered: Jun 5, 2020
Breach occurred: Jun 5, 2020
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jul 31, 2020
Affected individuals: 738nationwide
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium

During the incident: Filed a police report with local law enforcement
Began investigating the issue
CyberSecurity team assessed the situation, determined what was on the laptop, and the scope of any potential breach
Changes made: Enhancing policies related to transporting laptops between worksites
Re-educating its workforce about proper security safeguards
Conducting a thorough security assessment to ensure all appropriate cybersecurity safeguards are in place
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(59 days from discovery to filing)
Compliance flags: CA 60-day OK · 56d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 5, 2020
→ Notified: Jul 31, 2020
56d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 5, 2020 → Notified: Jul 31, 2020	56d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

HHS OCRAug 3 · first

California State AGAug 3 · first · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-192669
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 3, 2020
Raw hash: bcdd38a5deb77692fc5c7b6c8d5bac307109c0367c12fe51c64f25f8da9e3503

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityHoag Clinic

Victim entityHoag Clinic

Incidentdiscovered Jun 5, 2020

Stated responseFiled a police report with local law enforcement

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov