HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 30, 2016.
- Organization as reported
- Louisiana Health Cooperative, Inc. in Rehabilitation, LA
- Entity type as reported
- Health Plan
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Other
- Submission date
- Nov. 30, 2016
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14343, row:5482)
- Archived copy
- Held in the private archive (provenance)
OCR opened an investigation of the covered entity (CE), Louisiana Health Cooperative, Inc., after it reported a breach involving its business associate (BA), Summit Reinsurance Services, Inc. The BA discovered ransomware on a server containing the unencrypted electronic protected health information (ePHI) of approximately 8,000 members of the CE. The ePHI included social security numbers, insurance and treatment information, and other demographic information. Upon discovery of the breach, the BA initiated an investigation to determine the nature and extent of the attack as well as to assess the system vulnerabilities. The CE provided breach notification to HHS and posted substitute notice on its website. The BA provided breach notification to the affected individuals and the media. OCR verified that CE had a proper BA agreement in place, which restricted the BA's use and disclosure of PHI and required the BA to safeguard all PHI.