Lafourche Medical Group

Lafourche Medical Group (LMG) has paid $480,000 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and agreed to implement a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Breach Notification Rules. LMG is a Louisiana medical group specializing in emergency medicine, occupation medicine, and laboratory testing. On May 28, 2021, LMG filed a breach report with HHS stating that a hacker, through a successful phishing attack on March 30, 2021, gained access to an email account that contained electronic protected health information (ePHI). The type of ePHI involved included names, addresses, dates of birth, dates of service, email addresses, telephone numbers, medical record numbers, insurance/health plan beneficiary numbers, guarantor names, diagnoses, and lab results for approximately 34,862 individuals. OCR’s investigation revealed that, prior to the 2021 reported breach, LMG failed to conduct a risk analysis to identify potential threats or vulnerabilities to ePHI across the organization as required by HIPAA. OCR also discovered that LMG had no