USR HOLDINGS, LLC

HHS OCR settled a HIPAA Security Rule investigation with USR Holdings, LLC, a Florida business associate, for $337,750. The settlement resolved allegations that USR failed to maintain retrievable exact copies of electronic protected health information (ePHI) after an unauthorized third party deleted ePHI from a database in 2018. USR agreed to a corrective action plan including risk analysis and regular system reviews.

USR Holdings, LLC notified NH AG of a security breach affecting 223 NH residents. An employee misconfigured a firewall rule on Aug 23, 2018, exposing a database with PHI and PII (names, DOB, SSNs, insurance info) to unauthorized third parties until Dec 8, 2018. USR engaged forensic investigators, disabled the server, and offered credit monitoring.

USR Holdings LLC reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2019-02-12. 172 Massachusetts residents were affected. The report records the breach type as electronic.

On February 8, 2019, USR Holdings, LLC reported a hacking incident to HHS affecting 2,903 individuals. The breach, which occurred from August 23, 2018, to December 8, 2018, involved an unauthorized third party accessing and deleting electronic protected health information (ePHI) from a network server database. An OCR investigation resulted in a $337,750 settlement and a two-year corrective action plan for USR Holdings due to potential HIPAA Security and Privacy Rule violations.

USR HOLDINGS LLC filed a data-breach notice with the Illinois Attorney General during 2019 (case 2019-058). The register records the breach as discovered on August 23, 2018. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.