AccidentalHealthcareHealthcareMisconfigurationEmployee Data InvolvedPHIHealth (basic)LowContained

Trinity Village

bd_eeb48d5ad359bcba · schema v1 · pii pii-v1

Severity

Low

Discovered

Dec 1, 2024

Filed

Feb 7, 2025

To disclose

10 weeks

Affected

1state residents only

Confidence

67%

Full breach record for Trinity Village →

Trinity Village, a senior living community, notified the Maryland AG that staff used an unapproved, non-HIPAA-compliant mobile application to share non-critical PHI (lab/radiology results, condition changes) with one another. One Maryland resident was affected. No third-party access or financial data was compromised. Staff were instructed to stop using the app, communications were deleted, and staff were re-educated on HIPAA compliance.

J jump to incidentP pin to compareR raw source

Maryland clock⏱ MD AG >30d10 weeks discovery → filing

Incident timeline

discovery → filing · 10 weeks / 68 days

Dec 1, 2024

Discovered

Feb 7, 2025

Filed

vs. sector median

1 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed1 affectedView incident

Name: Kitch, Druce & Connolly, P.C.
norm: kitch druce connolly

Name: Trinity Village
norm: trinity village
Industry: Healthcarellm

Discovered: Dec 1, 2024
Materiality determined: —
Notification sent: —
Affected individuals: 1state-resident count only
Data types: PHIHealth (basic)
Attack vector: Misconfiguration
MITRE ATT&CK: T1074 Data Staged
Threat actor: Internal
Regulator citations: Notified Maryland Attorney General
Initial access: insider_action

During the incident: Asked all staff to cease the use of this application
Launched an investigation to determine the circumstances regarding the use of this application
Electronically deleted all communications between staff on the non-compliant application
Staff have been re-educated on HIPAA compliant communications
Enforced policy against the use of unapproved software applications
Changes made: Re-educated staff on HIPAA compliant communications
Enforced policy against the use of unapproved software applications
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(68 days from discovery to filing)
Compliance flags: MD AG >30d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.maryland.gov/resources-info/SBN%20Documents/2025/ITU-376337.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Feb 7, 2025
Raw hash: a5c8b8869222f6a45e18e27f5d3090ad9870e4308ab16cd7547609a8afe02a5f

Reporting entityKitch, Druce & Connolly, P.C.

Victim entityTrinity Village

Incidentdiscovered Dec 1, 2024

Stated responseAsked all staff to cease the use of this application

ComplianceMD AG >30d

Extraction provenanceno artifact recorded

Source provenanceoag.maryland.gov