HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of March 7, 2014.
- Organization as reported
- PracMan, Inc., AL
- Entity type as reported
- Business Associate
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- March 7, 2014
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15158, row:6297)
- Archived copy
- Held in the private archive (provenance)
On January 10, 2014, a business associate (BA), PracMan, Inc., of two covered entities (CE), Monarch Women’s Health (Monarch) and Punuru J.M. Reddy, M.D., Inc. (Dr. Reddy), impermissibly disclosed the protected health information (PHI) of the CEs’ patients when the BA’s technology subcontractor, MASHNet, copied and stored computer files in error on an unsecured server. The PHI included demographic, clinical, and financial information, including names, account numbers, insurance providers, procedures, diagnoses, social security numbers (SSN), and account balances affecting approximately 1,179 of Dr. Reddy’s patients and approximately 1,145 of Monarch’s patients. The BA provided breach notification to HHS, affected individuals, and the media. It also established a toll-free number and website dedicated to providing information regarding the breach, and offered one year of free credit monitoring to individuals whose SSN was potentially exposed online. In response to the breach, the BA engaged a third party to perform a risk analysis of its operations and updated its privacy and security policies. The BA ensured that the data was removed from the unsecured server and all cached copies of links to the PHI were removed. OCR obtained assurances that the BA implemented the corrective actions listed above. Additionally, the BA terminated its relationship with the subcontractor and restructured its corporate network.