FLORIDAMisuseHealthcareHealthcarePrivilege AbuseCustomer Data InvolvedData ExfiltratedDelayed DiscoveryPHIHealth (basic)Identity (basic)HighResolved

Public Health Trust of Miami-Dade County, Florida

bd_f66ee80739f10e41 · schema v1 · pii pii-v1

Severity

High

Financial impact

$2.15M

Discovered

Jan 1, 2013

Filed

Feb 19, 2016

To disclose

38 months

Affected

24,188

Confidence

68%

Full breach record for Public Health Trust of Miami-Dade County, Florida →

Public Health Trust of Miami-Dade County, Florida reported to HHS on 2016-02-19 a Unauthorized Access/Disclosure affecting 24188 individuals. Breached information located on Electronic Medical Record. An employee inappropriately accessed and sold patient PHI since 2011. The system failed to implement minimum necessary access controls and timely breach notification.

J jump to incidentP pin to compareR raw source

HIPAA clockDiscovered Jan 1, 2013 → Notified Feb 19, 20161144d ✗ HHS report late38 months discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 731 days

discovery → filing · 38 months / 1144 days

Jan 1, 2011

Begins

Jan 1, 2013

Discovered

Feb 19, 2016

Filed

vs. sector median

+152 wks slower

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed24,188 affectedView incident

Name: Public Health Trust of Miami-Dade County, Florida
norm: public health trust of miami dade county florida
Industry: Health Care Services

Name: Public Health Trust of Miami-Dade County, Florida
norm: public health trust of miami dade county florida
Industry: Healthcaresource default

Discovered: Jan 1, 2013
Breach occurred: Jan 1, 2011 – Feb 19, 2016
Undetected for: 731 daysoccurrence → discovery
Materiality determined: —
Notification sent: Feb 19, 2016
Affected individuals: 24,188nationwide
Data types: PHIHealth (basic)Identity (basic)
HHS breach type: Unauthorized access or disclosure
Where the data lived: Electronic medical record
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1119 Automated Collection
Threat actor: InternalFinancial
Regulator citations: Notified OCR of breachOCR initiated investigation following media reportPaid civil money penalty of $2,154,000
Initial access: insider_action

During the incident: Waived its right to a hearing
Did not contest the findings in OCR's Notice of Proposed Determination
Paid the full civil money penalty
Changes made: Failed to provide timely and accurate breach notification to the Secretary of HHS
Failed to conduct enterprise-wide risk analyses
Failed to manage identified risks to a reasonable and appropriate level
Failed to regularly review information system activity records
Failed to restrict authorization of its workforce members' access to patient ePHI to the minimum necessary
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 38 months(1144 days from discovery to filing)
Compliance flags: HHS report late · 1144dHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Jan 1, 2013
→ Notified: Feb 19, 2016
1144d 60 days HHS report late
HIPAA
Discovered: Jan 1, 2013
→ Notified: Feb 19, 2016
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Jan 1, 2013 → Notified: Feb 19, 2016	1144d	60 days	HHS report late
HIPAA	Discovered: Jan 1, 2013 → Notified: Feb 19, 2016	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Feb 19, 2016
Raw hash: 6b60743e0a3cd395c6d8376747ecf3a8fe88085b546caa497d1c117244308f71

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html3.9 KB

Download View at source

Reporting entityPublic Health Trust of Miami-Dade County, Florida

Victim entityPublic Health Trust of Miami-Dade County, Florida

Incidentdiscovered Jan 1, 2013

Stated responseWaived its right to a hearing

ComplianceHHS report late

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing