Emory Healthcare data breach (2012)

Breach window

Feb 20, 2012

When the intrusion reportedly occurred, per the linked filings

Breach discovered

Feb 20, 2012

Reported by HHS OCR filing

58 days

GAHHS OCRFirst filing

Filed Apr 18, 2012bd_93a3b3ade6091792

Emory Healthcare (GA) reported to HHS on 2012-04-18 that on February 20, 2012, ten unencrypted backup CDs containing ePHI were discovered missing. Clinical and demographic data for 315,000 surgical patients treated at three locations between September 1990 and April 2007 were affected. The CDs could only be read using decommissioned software. Breach notification was provided to HHS, affected individuals, and the media. Remediation included PHI inventory requirements and staff education. OCR obtained assurances of corrective action.

Affected (this filing): 315,000

HHS notified

🐻California State AGMost recentlinked via same-victim cross-source · 95%

Filed May 16, 2012bd_3b3a896a7ff97ad2

Emory Healthcare, Inc. reported a data breach to the California Attorney General. The breach occurred on February 20, 2012. The provided source document contains only the filing metadata and an empty attachment placeholder; no narrative details regarding the nature of the breach, data types affected, or number of individuals impacted are available in the text.

Emory Healthcare

Litigation Timing

Timeline