An unknown assailant associated with a foreign IP address attempted to bypass the security mechanisms of a computer server of a former third party administrator and business associate (BA), AssureCare Risk Management, of the covered entity (CE), Lansing Community College Dental Care Plan. Approximately 5,000 individuals were affected by the breach. The server contained protected health information (PHI) regarding some of the CE’s participants such as names, addresses, social security numbers and clinical information, including information regarding healthcare providers and types of service. The BA provided breach notification to HHS, affected individuals, and the media. Following the breach, the BA shut down the unsecured server and hired Kroll Background America, a forensic computer security service, to investigate the nature and extent of the unauthorized access. Kroll’s findings indicated that it was unlikely that any of the CE’s member data was taken. The BA also reviewed and reevaluated its security policies and related BA agreements. OCR obtained written documentation that the BA implemented the corrective actions listed above.
