AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedEmployee Data InvolvedPHIHealth (basic)Identity (basic)MinorMediumResolved

RADY CHILDREN'S HOSPITAL SAN DIEGO

bd_ea12d929eca7e68c · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 12, 2018

Filed

May 3, 2018

To disclose

21 days

Affected

Not disclosed

Confidence

65%

Full breach record for RADY CHILDREN'S HOSPITAL SAN DIEGO →5 incidents on file

Rady Children's Hospital-San Diego inadvertently included patient health information on a CD sent to a contracted entity for Quality Control purposes on March 29, 2018. The hospital became aware of the error on April 12, 2018, when the recipient reported the inclusion of patient data. The CD contained names, medical record numbers, dates of birth, and clinical measurements for minor patients. The data was secured upon return. The incident was classified as a misdelivery error.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 12, 2018 → Notified May 3, 201821d ✓ CA 60-day OK21 days discovery → filing

Incident timeline

undetected · 14 days

discovery → filing · 21 days

Mar 29, 2018

Begins

Apr 12, 2018

Discovered

May 3, 2018

Filed

vs. sector median

8 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: RADY CHILDREN'S HOSPITAL SAN DIEGO
norm: rady children s hospital san diego

Name: RADY CHILDREN'S HOSPITAL SAN DIEGO
norm: rady children s hospital san diego
Industry: Healthcarellm

Discovered: Apr 12, 2018
Breach occurred: Mar 29, 2018
Undetected for: 14 daysoccurrence → discovery
Materiality determined: —
Notification sent: May 3, 2018
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Minor
Attack vector: Unknown
Regulator citations: Reported to the California Department of Public Health

During the incident: Received and secured the CD from the contracted entity
Reviewed the incident
Re-educated staff regarding privacy policies
Reported the incident to the California Department of Public Health
Changes made: Reiterate the importance of carefully handling confidential information
Identify every opportunity to enhance the security of patient information in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 21 days(21 days from discovery to filing)
Compliance flags: CA 60-day OK · 21d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 12, 2018
→ Notified: May 3, 2018
21d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 12, 2018 → Notified: May 3, 2018	21d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-135853
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 3, 2018
Raw hash: 11ce4c5ffdca3a2ca5cb327e6ef313d2c63f4eb642c84a365c8ad7dd29d9ce84

Reporting entityRADY CHILDREN'S HOSPITAL SAN DIEGO

Victim entityRADY CHILDREN'S HOSPITAL SAN DIEGO

Incidentdiscovered Apr 12, 2018

Stated responseReceived and secured the CD from the contracted entity

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov