HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Aug. 8, 2011.
- Organization as reported
- Ashley Industrial Molding, Inc. Employee Welfare Benefit Plan, IN
- Entity type as reported
- Business Associate
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Aug. 8, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15802, row:6941)
- Archived copy
- Held in the private archive (provenance)
A computer server belonging to a former business associate (BA) and third party administrator, AssureCare Risk Management, Inc., was hacked. The server contained social security numbers, birth dates, names, addresses, gender, and physician and hospital/facility names linked with benefit payment information which could include type of service (i.e. office visit, inpatient stay, lab and x-ray, physical therapy, etc.). The breach affected 506 individuals. The relationship between the BA and the covered entity, Ashley Industrial Molding, Inc. Employee Welfare Benefit Plan, ended in 2006, but the BA continued to retain possession of protected health information (PHI) relating to the Plan’s participants because it was required to do so by law. The CE provided breach notification to HHS, affected individuals, and the media. OCR reviewed the BA agreement between the BA and CE which contained provisions regarding the use, disclosure, and safeguarding of PHI that ended in 2006, but also contained language requiring the BA to extend the protections of the agreement to the CE’s PHI after the agreement terminated. The CE obtained assurances that the BA shut down the server in question following the breach and does not maintain unsecured PHI on any other server. OCR obtained written assurances that the CE implemented the corrective actions noted above.