Lafayette Pain Care

Malware infected a business associate (BA), Bizmatics, Inc., and certain electronic systems containing protected health information (PHI) for the covered entity (CE), Lafayette Pain Care, were accessed in 2015. The breach affected 7,500 individuals’ PHI and included diagnoses/conditions, lab results, medications, and other treatment information. The CE provided breach notification to HHS, affected individuals, and the media, and also provided substitute notice on its website, established a call center with a toll-free phone number, and provided free credit monitoring and reporting services for one year. The CE executed a new BA agreement with Bizmatics with provisions regarding the use, disclosure, and safeguarding of PHI and made its Notice of Privacy Practices available on its website. OCR obtained documented assurances that the CE implemented the corrective actions noted above.