Laboratory Medicine Consultants, Ltd.

On May 15, 2019, the covered entity (CE), Laboratory Medicine Consultants, Ltd., learned through correspondence directed to its managing entity, Aurora Diagnostics, that a business associate (BA), American Medical Collection Agency, had discovered a potential data security incident. Upon initial review, the CE reported that the incident affected 140,590 individuals; however, after further analysis, the CE amended its report to indicate that 144,775 individuals were affected. The breach compromised the BA’s payment website and potentially the protected health information (PHI) of the CE’s patients with overdue accounts. The types of PHI involved included demographic, clinical, and financial information. In response to the breach, the CE ceased using the BA for collection efforts and informed affected individuals that payments for outstanding balances should no longer be made to AMCA. The CE provided breach notification to individuals, the media and HHS. The CE cooperated with OCR’s investigation and provided all requested documents and information to demonstrate its reasonable compliance efforts. Notably, the CE demonstrated it had a preexisting BA agreement, via Aurora Diagnostics, with the BA, that sufficiently meets the requirements of the Privacy Rule.