Louisiana State University Health Care Services Division

Electronic protected health information (ePHI) was used and disclosed by a workforce member of the covered entity (CE), Louisiana State University Health Care Services Division, to produce fraudulent checks and steal cash. The ePHI included the checking accounts, driver’s licenses, social security numbers, and other demographic information for approximately 6,994 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Upon discovering the breach, the CE sanctioned the involved workforce member. The CE improved physical security by adopting new security procedures. OCR obtained assurances that the CE implemented the corrective actions listed.