HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of July 15, 2013.
- Organization as reported
- Hansen and Associates, Inc., WY
- Entity type as reported
- Business Associate
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Desktop Computer
- Submission date
- July 15, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15365, row:6504)
- Archived copy
- Held in the private archive (provenance)
Hansen and Associates, Inc., the covered entity (CE), reported that between May 21, 2013, and May 29, 2013, its employee inappropriately used her workstation in violation of its policies on multiple occasions. The employee added software programs that allowed her to remotely access a desktop computer from her personal computer and store information in the cloud for personal access. The employee’s conduct temporarily affected the CE’s ability to access protected health information (PHI) maintained on the workstation. The breach affected 2,700 individuals and the types of PHI involved included, names, social security numbers, addresses, date of births, claims, and clinical diagnoses and conditions. The CE provided breach notification to the affected individuals, the media, and HHS. Upon discovering the breach, the CE conducted an internal investigation with assistance from an information technology vendor; notified local law enforcement regarding its employee’s misconduct; implemented physical, administrative, and security safeguards in response to the subject incident; and drafted new policies and procedures regarding its obligations under the Privacy, Security, and Breach Notification Rules. OCR obtained assurances that the CE implemented the corrective actions noted above.