HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 10, 2014.
- Organization as reported
- M&M Computer Services, TX
- Entity type as reported
- Business Associate
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Oct. 10, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14957, row:6096)
- Archived copy
- Held in the private archive (provenance)
An unknown third party intruder hacked into a server of a business associate (BA) which maintained electronic health records for the covered entity (CE), Penn Highlands Brookville. The breach potentially affected the protected health information (PHI) of 4,500 individuals and included names, dates of birth, social security numbers, and clinical information. The CE provided breach notification to HHS, affected individuals, and the media, and offered affected individuals one year of credit monitoring. Following the breach, the CE terminated its relationship with the BA. OCR initiated a compliance review of the BA in July of 2015, but learned that it was no longer doing business or acting as a BA. As a result of OCR’s investigation, the CE developed a checklist to use to ensure that electronic health record systems used by medical practices acquired by the CE comply with the HIPAA Privacy and Security Rules and to ensure that proper BA agreements are in place.