UnknownHealthcareHealthcareCustomer Data InvolvedPHIHealth (basic)Identity (basic)LowContained

Birch Medical

bd_ec4db6754055750b · schema v1 · pii pii-v1

Severity

Low

Discovered

Sep 1, 2024

Filed

Mar 3, 2025

To disclose

26 weeks

Affected

Not disclosed

Linked

4 filings

Confidence

65%

Full breach record for Birch Medical →

Birch Medical LLC notified the California Attorney General of an incident in September 2024 where unauthorized individuals may have accessed a folder containing patient health information and names. The investigation could not confirm if files were accessed, but notices were sent out of an abundance of caution. No SSNs or financial data were involved. Affected individuals include residents of California and Rhode Island.

J jump to incidentP pin to compareR raw source

California clockDiscovered Sep 1, 2024 → Notified Feb 27, 2025179d ✗ CA 60-day late26 weeks discovery → filing

Incident timeline

discovery → filing · 26 weeks / 183 days

Sep 1, 2024

Begins

Sep 1, 2024

Discovered

Mar 3, 2025

Filed

vs. sector median

+14 wks slower

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maryland State AGbd_21643f37fa4a20c42025-03-03Verified
Montana State AGbd_3d885f4429eec6ef2025-02-27 · +4dCandidate
Vermont State AGbd_50d383c5c1fa63f32025-02-27 · +4dVerified

Name: Birch Medical
norm: birch medical

Name: Birch Medical
norm: birch medical
Industry: Healthcarellm

Discovered: Sep 1, 2024
Breach occurred: Sep 1, 2024
Undetected for: 0 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 27, 2025
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)
Attack vector: Unknown

During the incident: Implemented additional technical and administrative safeguards to protect information within its care
Completed a thorough and detailed review of the folder to determine whether the within files contained sensitive information and to whom that information relates
Continues to review its existing policies and training protocols relating to data protection on an ongoing basis
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 26 weeks(183 days from discovery to filing)
Compliance flags: CA 60-day late · 179d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Sep 1, 2024
→ Notified: Feb 27, 2025
179d 60 days (analyst band, pre-2026 discoveries) CA 60-day late

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Sep 1, 2024 → Notified: Feb 27, 2025	179d	60 days (analyst band, pre-2026 discoveries)	CA 60-day late

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Montana State AGFeb 27 · first

Vermont State AGFeb 27 · first

Maryland State AG+4d

California State AG+4d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-599367
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Mar 3, 2025
Raw hash: 69f6cfff86bf9c6d6103bc5db5ac3e5f7a4df3807389484541ede99c7e31e5b7

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityBirch Medical

Victim entityBirch Medical

Incidentdiscovered Sep 1, 2024

Stated responseImplemented additional technical and administrative safeguards to protect information within its care

ComplianceCA 60-day late

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov