Franciscan Health, Highline Medical Center
bd_ed57466eafcc0aa4 · schema v1 · pii pii-v1
Full breach record for Franciscan Health, Highline Medical Center →CHI Franciscan Health Highline Medical Center (WA) reported to HHS OCR on 2016-09-01 an Unauthorized Access/Disclosure affecting 18,399 individuals. A business associate inadvertently left files containing patient ePHI publicly accessible via the internet from approximately mid-April 2016 to June 13, 2016. Breached information located on Network Server included patient names, dates of service, health insurance information, and Social Security numbers. Following the breach, the CE terminated the BA relationship and the BA deleted all patient files from its systems.
Linked disclosures
Why this link?Regulatory filings (1) · sorted by filing gap
- bd_efb4bbdc33642a3eMontana State AGfiled 2016-08-31(1d gap)Verified
Source provenance
- Source URL
- https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
- Filed at
- Sep 1, 2016
- Raw hash
- 47257079963251b56e5073d72fb631ec3ad897adba375588028acdcc110d7b00
Source filing
Reporting entity
- Name
- Franciscan Health, Highline Medical Centernorm: franciscan health highline medical center
- Industry
- Health Care Services
Victim entity
- Name
- Franciscan Health, Highline Medical Centernorm: franciscan health highline medical center
- Industry
- Health Care Services
- Industry
- Healthcaresource default
Incident
- Discovered
- Jun 13, 2016
- Materiality determined
- —
- Notification sent
- —
- Affected individuals
- 18,399
- Data types
- HEALTH_BASICIDENTITY_BASICIDENTITY_GOVERNMENTFINANCIAL_ACCOUNT
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1190 Exploit Public-Facing Application
- Threat actor
- Partner
- Regulator citations
- HHS OCR reviewed BA agreement in place at time of breach; OCR obtained assurances regarding individual notification, media notification, credit monitoring, and call center establishment.
Compliance
- Time to disclose
- 11 weeks(80 days from discovery to filing)
- Compliance flags
- HHS notified
- Discovery-date grounding
- unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
- Clock breakdown
Statute Window Elapsed Threshold Status HIPAA Discovered: Jun 13, 2016→ Notified: not extracted— regulatory submission HHS notified
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.