mscripts

Disclosed Jan 17, 202388,923 affectedConfirmed

The business associate (BA), mscripts, reported that a cloud storage asset lacked appropriate security safeguards that could have allowed the unauthorized access to the protected health information (PHI) of 88,923individuals. The PHI involved included names, dates of birth, addresses, medication information, and health insurance information. The BA notified HHS, affected individuals, and the media. The BA strengthened its technical and security safeguards to better protect its sensitive data. OCR provided technical assistance regarding the HIPAA Rules.

What is known

People affected	88,923 (as reported to HHS)
Disclosed	Jan 17, 2023
Discovered	Nov 18, 2022
Happened	Sep 30, 2016
Attack	Lost or stolen device
Data exposed	NamesHealth
Sector	Healthcare · US
Status	Confirmed

Sources

Official noticeoag.ca.gov

California Attorney General breach notice: mscripts

Official noticeatg.wa.gov

Washington Attorney General breach notice: mscripts

Official noticejustice.oregon.gov

Oregon DOJ breach notice: mscripts

Official noticeocrportal.hhs.gov

HHS OCR breach report (archive, resolved): mscripts® (Business Associate, CA)

Notices filed

TotalJan 17, 2023

HHS archive88,923 people

Residents of CAMar 14, 2023

California AGCount not stated

Residents of WAMar 14, 2023

Washington AG1,394 people

Residents of ORMar 14, 2023

Oregon DOJ5,725 people

History of this record

data_types2026-09-25

[] to ["names","health"]by backfillSource

records_basis2026-09-25

empty to hhsby backfillSource

records2026-09-25

empty to 88923by backfillSource

disclosed2026-09-25

2023-03-14 to 2023-01-17by backfillSource

summary2026-09-25

empty to The business associate (BA), mscripts, reported that a cloud storage asset lacked appropriate security safeguards that could have allowed the unauthorized access to the protected health information (PHI) of 88,923individuals. The PHI involvby backfillSource

sector2026-09-25

other to healthby backfillSource

attack2026-09-25

unknown to lost-deviceby backfillSource

discovered2026-09-25

empty to 2022-11-18by backfillSource

Added2026-09-25

First recordedby backfillSource

First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.

Everything about mscripts