MisuseHealthcareHealthcarePrivilege AbuseSupply Chain (3P Vendor)Customer Data InvolvedPHIHealth (basic)Government IDIdentity (basic)Financial accountMediumContained

Mercy Medical Center Redding

bd_efb106d22d603700 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Jun 6, 2016

Filed

Jun 24, 2016

To disclose

18 days

Affected

Not disclosed

Linked

2 filings

Confidence

65%

Full breach record for Mercy Medical Center Redding →

Mercy Medical Center Redding notified patients that an employee of its business partner, naviHealth, accessed patient medical information inappropriately between June 1 and June 13, 2016. The case manager was working under a false name and nursing license. Affected data included clinical information, SSNs, and health insurance details. naviHealth severed ties with the employee, contacted law enforcement, and offered credit monitoring.

J jump to incidentP pin to compareR raw source

California clockDiscovered Jun 6, 2016 → Notified Jun 9, 20163d ✓ CA 60-day OK18 days discovery → filing

Incident timeline

undetected · 5 days

discovery → filing · 18 days

Jun 1, 2016

Begins

Jun 6, 2016

Discovered

Jun 24, 2016

Filed

vs. sector median

6 wks faster

This filing is one of 2 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_80db4078409e61bb2016-06-29 · +5dVerified by operator

Name: Mercy Medical Center Redding
norm: mercy medical center redding

Name: Mercy Medical Center Redding
norm: mercy medical center redding
Industry: Healthcarellm

Discovered: Jun 6, 2016
Breach occurred: Jun 1, 2016 – Jun 13, 2016
Undetected for: 5 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jun 9, 2016
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Government IDIdentity (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Insider
Threat actor: Partner
Third party: via naviHealth
Initial access: trusted_relationship

During the incident: Severed ties with the case manager and prevented further computer access
Contacted law enforcement
Cooperating in the on-going investigation
Reviewed recorded calls for content and clinical accuracy
Confirmed all current employees’ nursing licenses and identification as authentic
Offering 12 months of free credit monitoring through IDT 911
Changes made: Additional screening processes will occur when new employees are hired
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 18 days(18 days from discovery to filing)
Compliance flags: CA 60-day OK · 3d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Jun 6, 2016
→ Notified: Jun 9, 2016
3d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Jun 6, 2016 → Notified: Jun 9, 2016	3d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

California State AGJun 24 · first · this page

HHS OCR+5d

Pattern: first filing Jun 24 (CA), last Jun 29 (CA) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-62536
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jun 24, 2016
Raw hash: e82d1ff2015c7c15e5e151629a764233fbf960825a1a2ae56ea4100cbe772527

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityMercy Medical Center Redding

Victim entityMercy Medical Center Redding

Incidentdiscovered Jun 6, 2016

Stated responseSevered ties with the case manager and prevented further computer access

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov