HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Oct. 17, 2025.
- Organization as reported
- McElroy & Associates, Inc., OK
- Entity type as reported
- Business Associate
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Submission date
- Oct. 17, 2025
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 9117, row:256)
- Archived copy
- Held in the private archive (provenance)
The business associate (BA), McElroy & Associates, Inc., reported that an employee’s email account containing protected health information (PHI) was accessed by an unauthorized threat actor. According to the breach report, the breach affected approximately 6,633 individuals. The PHI involved names, dates of births, address/zip codes, social security numbers, drivers’ license numbers, other identifier, claims information, credit card/bank account numbers, medications, diagnosis/conditions, and other treatment information. The BA notified HHS, affected individuals, and the media. In its mitigation efforts, the BA provided security awareness training to its workforce and enhanced its access controls to better protect its PHI. OCR provided technical assistance to the BA regarding the HIPAA Rules and obtained documentation substantiating the BA’s actions.