PhysicalHealthcareHealthcareLossCustomer Data InvolvedIdentity (basic)Government IDHealth (basic)MediumContained

Women and Infant's Hospital

bd_fc759fe141756f60 · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 13, 2012

Filed

Nov 5, 2012

To disclose

8 weeks

Affected

12state residents only

Linked

3 filings

Confidence

67%

Full breach record for Women and Infant's Hospital →3 incidents on file

Women & Infants Hospital notified the NH AG on Nov 5, 2012, of missing unencrypted backup tapes containing PHI and PII (SSN, DOB, names) from sites in RI and MA. Discovered Sept 13, 2012. ~12 NH residents affected. Credit monitoring offered. No evidence of improper access.

J jump to incidentP pin to compareR raw source

Incident timeline

discovery → filing · 8 weeks / 53 days

Sep 13, 2012

Discovered

Nov 5, 2012

Filed

vs. sector median

2 wks faster

This filing is one of 3 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (2) · sorted by filing gap

HHS OCRbd_17287f13971cec772012-11-05Verified
Massachusetts State AGbd_5fbf33122f08a6672012-11-06 · +1dVerified

Name: Women and Infant's Hospital
norm: women and infant s hospital

Name: Women and Infant's Hospital
norm: women and infant s hospital
Industry: Healthcarellm

Discovered: Sep 13, 2012
Materiality determined: —
Notification sent: Nov 5, 2012
Affected individuals: 12state-resident count only
Data types: Identity (basic)Government IDHealth (basic)
Data elements: Social Security numberDate of birth
Attack vector: Unknown
MITRE ATT&CK: T1052 Exfiltration Over Physical Medium
Regulator citations: Notified New Hampshire Office of the Attorney General

During the incident: Began an investigation and conducted a thorough search of its facilities
Notifying affected patients
Offering eligible individuals one year of free credit monitoring provided by TransUnion Interactive
Providing call center support for those affected
Changes made: Thorough review of its policies and procedures
Enhancement of its backup tape receipt and storage practices
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 3 filings · 3 states

View merged incident ↗

HHS OCRNov 5 · first

New Hampshire State AGNov 5 · first · this page

Massachusetts State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/women-infants-hospital-20121105.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 5, 2012
Raw hash: f9ad61668856a57be78dce628568cf19b1dff4c8c29b50c2f3ea32a675d2523a

Linked disclosures

Regulatory filings (2) · sorted by filing gap

Reporting entityWomen and Infant's Hospital

Victim entityWomen and Infant's Hospital

Incidentdiscovered Sep 13, 2012

Stated responseBegan an investigation and conducted a thorough search of its facilities

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov