RADY CHILDREN'S HOSPITAL SAN DIEGO

Rady Children's Hospital - San Diego notified Montana residents of a third-party data breach involving Blackbaud, Inc. Unauthorized access to backup files occurred between Feb 7 and Jun 4, 2020. Personal information of community members was contained in the files. The incident was discovered on Oct 7, 2020. No misuse was confirmed. Identity monitoring services were offered.

Rady Children’s Hospital – San Diego reported to HHS on 2020-10-30 a Hacking/IT Incident affecting 19,837 individuals. Breached information located on Network Server. The covered entity's business associate experienced a ransomware attack affecting ePHI including names, addresses, dates of birth, clinical information, and financial information. The CE offered complimentary credit monitoring and identity theft protection services.

Rady Children's Hospital San Diego reported to HHS on 2020-02-21 a Unauthorized Access/Disclosure affecting 2360 individuals. Breached information located on Network Server. A vulnerability on the network server allowed ePHI (names, financial, and treatment info) to be accessible via the Internet. The entity notified HHS, individuals, and media, provided credit monitoring, and implemented additional safeguards.

Rady Children's Hospital San Diego disclosed unauthorized access to radiology-related patient information via an Internet port between June 20, 2019, and January 3, 2020. The incident was discovered on January 3, 2020. Affected data included patient names, gender, dates of birth, medical record numbers, and imaging study details, but excluded SSNs, credit cards, and diagnoses. The hospital secured the information, engaged forensic investigators, and offered 12 months of identity protection.

RADY CHILDREN'S HOSPITAL filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-458). The register records the breach as discovered on February 7, 2020. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

RADY'S CHILDREN'S HOSPITAL SAN DIEGO filed a data-breach notice with the Illinois Attorney General during 2020 (case 20-075). The register records the breach as discovered on February 21, 2020. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.

Rady Children's Hospital-San Diego inadvertently included patient health information on a CD sent to a contracted entity for Quality Control purposes on March 29, 2018. The hospital became aware of the error on April 12, 2018, when the recipient reported the inclusion of patient data. The CD contained names, medical record numbers, dates of birth, and clinical measurements for minor patients. The data was secured upon return. The incident was classified as a misdelivery error.

Rady Children's Hospital - San Diego reported to HHS OCR on 2014-06-25 an Unauthorized Access/Disclosure breach affecting 6,307 individuals. Breached information was located on Email and Other media. No business associate was identified as involved. The web description was not provided; further details of the unauthorized access or disclosure are not publicly available from this filing.

Rady Children's Hospital - San Diego reported to HHS on 2014-06-24 a Unauthorized Access/Disclosure affecting 14121 individuals. Breached information located on Email.

Rady Children's Hospital-San Diego reported a data breach to the California Attorney General. The incident involved unauthorized access to patient records occurring between November 30, 2009, and June 6, 2014. The breach affected Protected Health Information (PHI) and basic identity data. The specific cause of the breach and the number of affected individuals are not disclosed in the available filing metadata or redacted notice samples.