Louisiana Health Cooperative, Inc. in Rehabilitation

OCR opened an investigation of Louisiana Health Cooperative, Inc. (CE) after it reported a breach involving its business associate, Summit Reinsurance Services, Inc. (BA). The BA discovered ransomware on a server containing unencrypted ePHI of approximately 8,000 CE members. Affected ePHI included Social Security numbers, insurance and treatment information, and other demographic information. The BA investigated, the CE notified HHS and posted substitute notice on its website, and the BA notified affected individuals and the media. OCR verified a proper BA agreement was in place.