Ashley Industrial Molding, Inc. Employee Welfare Benefit Plan

A computer server belonging to a former business associate (BA) and third party administrator, AssureCare Risk Management, Inc., was hacked. The server contained social security numbers, birth dates, names, addresses, gender, and physician and hospital/facility names linked with benefit payment information which could include type of service (i.e. office visit, inpatient stay, lab and x-ray, physical therapy, etc.). The breach affected 506 individuals. The relationship between the BA and the covered entity, Ashley Industrial Molding, Inc. Employee Welfare Benefit Plan, ended in 2006, but the BA continued to retain possession of protected health information (PHI) relating to the Plan’s participants because it was required to do so by law. The CE provided breach notification to HHS, affected individuals, and the media. OCR reviewed the BA agreement between the BA and CE which contained provisions regarding the use, disclosure, and safeguarding of PHI that ended in 2006, but also contained language requiring the BA to extend the protections of the agreement to the CE’s PHI after the agreement terminated. The CE obtained assurances that the BA shut down the server in question following