Provenance Record

Clean, well-structured News piece using the Overview / What We Know / What We Don't Know format. 444 words, within the 400-1200 range for News. Neutral, factual tone throughout; no sensationalism or editorializing; no AI self-reference.

All 4 source snapshots read in full from disk (gunzip'd source-0..3.html.gz in sources/2026-07/malware-attack-forces-south-carolina-health-system-anmed-to-close-79-of-106-facilities/) after verifying each file's sha256 against manifest.json (all matched). All 4 fetched at HTTP 200, no archive_fallback, no suspicious_patterns in the manifest. (1) therecord.media (source-0): confirms nonprofit health system serving SC/Georgia, malware disruption, Sunday statement, 4 hospitals + 60 physician practices, and the verbatim 'We are coordinating closely with emergency medical services...' quote. (2) hipaajournal.com (source-1): confirms the exact '79 of its 106 facilities' figure, the list of closed vs. open facility types, the verbatim 'a cybersecurity disruption involving malware' language, and the 'What We Don't Know' claims verbatim -- 'too early to tell to what extent, if any, patient data was involved' and 'No threat group appears to have claimed responsibility'. (3) foxcarolina.com (source-2): confirms the verbatim AnMed quote 'We are currently experiencing a cybersecurity disruption involving malware that is impacting our network,' FBI Columbia Field Office + SLED involvement, paper documentation/handwritten orders, personal cell phone use, and slower lab/imaging/medication processing. (4) wgog.com (source-3): confirms Tuesday July 28 statement, physician offices reopening for scheduled appointments, Kids Care/Urgent Care open for walk-ins, the verbatim 'forensic review is still in its early stages' quote, and the instruction to bring medications in original containers. No hallucinated quotes, no misattribution, no unsupported specifics found anywhere in body_markdown -- every claim, number, date and direct quote traces cleanly to its cited source.

Headline, summary and lead (Overview) are each fully supported: the '79 of 106 facilities' figure is verbatim from HIPAA Journal, the ER-stayed-open claim is verbatim from Fox Carolina/HIPAA Journal, and the Tuesday physician-office-reopening claim is verbatim from WGOG. However, the submission's `tags` array (part of the signed article payload) includes 'ransomware' and 'data breach.' Neither term appears anywhere in any of the four source snapshots in connection with this AnMed incident -- all four sources consistently describe it only as a 'malware' disruption. HIPAA Journal explicitly states investigators have not yet determined 'to what extent, if any, patient data was involved,' and that 'No threat group appears to have claimed responsibility' -- meaning neither a ransomware attribution nor a confirmed data breach is supported by any cited reporting as of the sources reviewed. The body_markdown itself is careful and never asserts either term, so this is a metadata-only issue, but tags are reader-facing (used for browsing/categorization) and cannot be edited post-signature without breaking the payload hash, so it requires a corrections record rather than a silent fix.

Substantively strong, accurately sourced News piece with verbatim quotes and every headline/summary/lead claim traced to a cited source. The single recoverable issue is the signed-payload tags asserting 'ransomware' and 'data breach' when no cited source supports either characterization at this stage of reporting. This is a subordinate metadata issue, not a headline/lead problem, and is honestly coverable with a single corrections note -- APPROVE_WITH_CORRECTIONS.