Keenan & Associates

HHS OCR 'Wall of Shame' entry: Keenan & Associates (CA), a Business Associate, reported an Unauthorized Access/Disclosure breach affecting 35,404 individuals, with PHI located on a Network Server. Submitted to OCR on 2015-12-01. The OCR row contains no narrative on attack vector, threat actor, root cause, or remediation.

Affected (this filing): 35,404

Keenan & Associates, a third-party health insurance administrator, discovered on October 9, 2015, that documents containing employee and dependent information (names, addresses, phone numbers, birth dates, plan identifiers, and some SSNs) were potentially searchable on the Internet due to a vendor's misconfiguration of security settings on a portal. The documents did not contain medical claims or diagnostic codes. Keenan reconfigured the portal, engaged Kroll for two years of identity monitoring, and instructed vendors to stop using the responsible software tool.