HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of July 25, 2019.
- Organization as reported
- Laboratory Medicine Consultants, Ltd., NV
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- July 25, 2019
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 13297, row:4436)
- Archived copy
- Held in the private archive (provenance)
On May 15, 2019, the covered entity (CE), Laboratory Medicine Consultants, Ltd., learned through correspondence directed to its managing entity, Aurora Diagnostics, that a business associate (BA), American Medical Collection Agency, had discovered a potential data security incident. Upon initial review, the CE reported that the incident affected 140,590 individuals; however, after further analysis, the CE amended its report to indicate that 144,775 individuals were affected. The breach compromised the BA’s payment website and potentially the protected health information (PHI) of the CE’s patients with overdue accounts. The types of PHI involved included demographic, clinical, and financial information. In response to the breach, the CE ceased using the BA for collection efforts and informed affected individuals that payments for outstanding balances should no longer be made to AMCA. The CE provided breach notification to individuals, the media and HHS. The CE cooperated with OCR’s investigation and provided all requested documents and information to demonstrate its reasonable compliance efforts. Notably, the CE demonstrated it had a preexisting BA agreement, via Aurora Diagnostics, with the BA, that sufficiently meets the requirements of the Privacy Rule.