Synthetic tenant: Kestrova Health (fictional), 442 receipts. Sixty days of activity are generated deterministically and anchored to the current hour, so expiry and breach clocks are live. Every receipt is signed at load with Ed25519 key ksv-47c7d4987f3a and re-verified by the same code the public verify API runs. Consents you sign in the patient journeys appear at the top of the registry, held only in your browser.
INC-2026-019: Discharge summary emailed to the wrong patient
Kestrova Kukatpally · became aware 20 Sep 2026, 11:30 am IST · about 1 person
A discharge summary for 1 patient was emailed to the wrong recipient, another patient with a similar name, from a ward desk. The recipient confirmed deletion in writing within 2 hours.
The four clocks
Report to CERT-In
CERT-In Directions, 28 Apr 2022: within 6 hours
Not a reportable cyber incident on these facts; decision recorded
Initial intimation to the Board
DPDP Rule 7(2)(a): without delay. Internal target 24h
Done 20 Sep, 4:30 pm
Intimation to each affected patient
DPDP Rule 7(1): without delay. Internal target 48h
Done 20 Sep, 2:30 pm
Detailed report to the Board
DPDP Rule 7(2)(b): within 72 hours
Done 22 Sep, 1:30 pm
Rule-matrix triage
- Severity
- low
- Board intimation
- Required (every breach)
- Patient intimation
- Required (every breach)
- CERT-In
- Assess and record
Deterministic rule matrix. Exposure vector: contained loss (encrypted, wiped or misdirected) (matched "wrong recipient", "emailed to"). Scale: 1 parsed from the text. Severity = vector 0 + scale 0 points = LOW. Board and patient intimation are not scored: DPDP requires both for every personal data breach. Factor coverage 100% is how many of the three matrix inputs the text supplied, not a confidence score.
AI second opinion
Advisory only. A model reads the incident; its answer is validated, then set beside the matrix. The matrix decides severity and no model decides a legal duty.
Immediate actions
- highContain: isolate affected systems and revoke exposed credentials · CISO
- mediumAssess whether the incident is CERT-In reportable; record the decision · CISO
- highIntimate the Data Protection Board without delay: nature, extent, timing, location, likely impact (Rule 7(2)(a)) · DPO
- highIntimate each affected patient without delay, in plain language and their language (Rule 7(1)) · DPO
- mediumFile the detailed report with the Board within 72 hours: causes, mitigation, remediation, patient intimations (Rule 7(2)(b)) · DPO
Drafts for DPO review
The hospital name, contact and triage come from the server. Drafts are never sent; filing and sending are out of scope here.
Initial intimation to the Board
Notice to affected patients
Closure record
Findings: Autocomplete picked a same-surname address. Recipient deletion confirmed in writing.
Change made: Outbound clinical email now requires the MRN in the subject to match the recipient record.