McElroy & Associates, Inc.

The business associate (BA), McElroy & Associates, Inc., reported that an employee’s email account containing protected health information (PHI) was accessed by an unauthorized threat actor. According to the breach report, the breach affected approximately 6,633 individuals. The PHI involved names, dates of births, address/zip codes, social security numbers, drivers’ license numbers, other identifier, claims information, credit card/bank account numbers, medications, diagnosis/conditions, and other treatment information. The BA notified HHS, affected individuals, and the media. In its mitigation efforts, the BA provided security awareness training to its workforce and enhanced its access controls to better protect its PHI. OCR provided technical assistance to the BA regarding the HIPAA Rules and obtained documentation substantiating the BA’s actions.