HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 21, 2011.
- Organization as reported
- Assurecare Risk Management, Inc., IL
- Entity type as reported
- Business Associate
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Network Server
- Submission date
- July 21, 2011
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15812, row:6951)
- Archived copy
- Held in the private archive (provenance)
The covered entity (CE), Gypsum Management & Supply, Inc. Medical and Dental Plan, is a management company for a network of drywall supply yards that offers group health plans for its employees. On May 9, 2011, the computer server of the CE’s former business associate (BA), Assurecare Risk Management, Inc., was hacked, exposing the demographic, clinical, and health insurance information for 25,330 of the CE’s employees, many of whom no longer worked with the CE at the time of the breach. The CE provided breach notification to HHS, to affected individuals, and to the media. Because the breach incident involved a BA and occurred prior to the September 23, 2013, compliance date, OCR verified that the CE had a proper BA agreement in place that restricted the BA’s use and disclosure of protected health information (PHI) and required the BA to safeguard all PHI. The CE’s internal investigation revealed little activity on the server as a result of the hack. In addition, no reports of misuse of information have been reported. OCR obtained assurances that the CE took the corrective actions listed above.