Assurecare Risk Management

The covered entity (CE), Gypsum Management & Supply, Inc. Medical and Dental Plan, is a management company for a network of drywall supply yards that offers group health plans for its employees. On May 9, 2011, the computer server of the CE’s former business associate (BA), Assurecare Risk Management, Inc., was hacked, exposing the demographic, clinical, and health insurance information for 25,330 of the CE’s employees, many of whom no longer worked with the CE at the time of the breach. The CE provided breach notification to HHS, to affected individuals, and to the media. Because the breach incident involved a BA and occurred prior to the September 23, 2013, compliance date, OCR verified that the CE had a proper BA agreement in place that restricted the BA’s use and disclosure of protected health information (PHI) and required the BA to safeguard all PHI. The CE’s internal investigation revealed little activity on the server as a result of the hack. In addition, no reports of misuse of information have been reported. OCR obtained assurances that the CE took the corrective actions listed above.