San Francisco Department of Public Health data breach (2018)

Breach window

Nov 20, 2017 → Dec 9, 2017

When the intrusion reportedly occurred, per the linked filings

Breach discovered

Dec 9, 2017

Reported by CALIFORNIA AG filing

Breach discoveredconflicts with Dec 9, 2017

Dec 27, 2017

Reported by HHS OCR filing

135 days

🐻California State AGFirst filing

Filed May 11, 2018bd_5d4e4a5c52a98a02

San Francisco Department of Public Health (SFDPH) notified patients of a data breach involving third-party vendor Nuance Communications. An unauthorized former Nuance employee accessed patient records between November 20 and December 9, 2017. The breach exposed PHI including names, dates of birth, and medical records, but excluded SSNs or financial data. Law enforcement delayed notification during a criminal investigation. Nuance took the system offline immediately upon discovery.

CA 60-day late · 153d

45 days

CALIFORNIAHHS OCRMost recentlinked via same-victim cross-source · 100%

Filed Jun 25, 2018bd_55d794beb502891b

San Francisco Department of Public Health reported to HHS on 2018-06-25 a Unauthorized Access/Disclosure affecting 900 individuals. Breached information located on Network Server. An individual gained unauthorized access to a business associate's network server and downloaded PHI (names, DOB, diagnoses) to an external hard drive. Notification was provided on May 11, 2018, following a law enforcement delay.

San Francisco Department of Public Health

Litigation Timing

Timeline