LSU Health Care Services Division

LSU Health Care Services Division, the covered entity (CE), reported that a prior workforce member improperly used her job-based access to view the protected health information (PHI) of approximately 1,471 patients from August 21, 2009, through March 16, 2014. The types of PHI involved in the breach included clinical, demographic, and financial information. Following the breach, the CE provided breach notification to HHS, affected individuals and the media. The CE also implemented an access monitoring system in its sole remaining hospital. OCR obtained assurances that the CE implemented the corrective actions noted above as well as a written assurances that the CE will re-train its staff.