AccidentalHealthcareHealthcareMisdeliveryCustomer Data InvolvedPHIHealth (basic)Identity (basic)EducationLowResolved

WestCoast Children's Clinic

bd_f890aa3ad9a4dfee · schema v1 · pii pii-v1

Severity

Low

Discovered

Apr 19, 2013

Filed

Apr 24, 2013

To disclose

5 days

Affected

Not disclosed

Confidence

65%

Full breach record for WestCoast Children's Clinic →2 incidents on file

WestCoast Children's Clinic experienced an unauthorized disclosure of protected health information (PHI) when a confidential psychological assessment report was incorrectly faxed to an unintended recipient on April 16, 2013, due to an incorrect fax number entered on the cover sheet. The clinic became aware of the error on April 19, 2013, after the unintended recipient notified them and shredded the document. The incident involved patient names, dates of birth, placement history, developmental and psychological treatment history, family history, educational history, and testing data. The clinic investigated the incident, reported it to the California AG and HHS, reviewed policies, and retrained staff.

J jump to incidentP pin to compareR raw source

California clockDiscovered Apr 19, 2013 → Notified Apr 22, 20133d ✓ CA 60-day OK5 days discovery → filing

Incident timeline

undetected · 3 days

discovery → filing · 5 days

Apr 16, 2013

Begins

Apr 19, 2013

Discovered

Apr 24, 2013

Filed

vs. sector median

10 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.ConfirmedView incident

Name: WestCoast Children's Clinic
norm: westcoast children s clinic
Domain: westcoastcc.org

Name: WestCoast Children's Clinic
norm: westcoast children s clinic
Domain: westcoastcc.org
Industry: Healthcarellm

Discovered: Apr 19, 2013
Breach occurred: Apr 16, 2013
Undetected for: 3 daysoccurrence → discovery
Materiality determined: —
Notification sent: Apr 22, 2013
Affected individuals: Not disclosed
Data types: PHIHealth (basic)Identity (basic)Education
Attack vector: Unknown
Regulator citations: Reported to California Office of the Attorney GeneralReported to United States Department of Health & Human Services

During the incident: Investigated the breach to determine how the unintentional error resulted in the release of protected health information
Reported the breach to California Office of the Attorney General
Reported the breach to the United States Department of Health & Human Services
Reviewed existing policies and procedures
Conducted a self-audit of procedures to identify any vulnerability that could result in this error occurring again
Reviewed existing faxing procedures
Changes made: Employee will receive disciplinary sanctions consistent with the level of privacy breach
Employee will be re-trained in privacy practices
All employees will be contacted to remind them of the priorities in protecting health information
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 5 days(5 days from discovery to filing)
Compliance flags: CA 60-day OK · 3d
Discovery-date grounding: letter-groundedThe discovery date is the detection date narrated in the notification letter — the defensible tier.
Clock breakdown: Statute Window Elapsed Threshold Status
California
Discovered: Apr 19, 2013
→ Notified: Apr 22, 2013
3d 60 days (analyst band, pre-2026 discoveries) CA 60-day OK

Statute	Window	Elapsed	Threshold	Status
California	Discovered: Apr 19, 2013 → Notified: Apr 22, 2013	3d	60 days (analyst band, pre-2026 discoveries)	CA 60-day OK

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-41576
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Apr 24, 2013
Raw hash: 78f9eda999f587fdb95ddcc9998a166817a0dcb55b6c7bb964dee6f8160f2db6

Reporting entityWestCoast Children's Clinic

Victim entityWestCoast Children's Clinic

Incidentdiscovered Apr 19, 2013

Stated responseInvestigated the breach to determine how the unintentional error resulted in the release of protected health information

ComplianceCA 60-day OK

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov