HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Phishing Attack on Acadiana Computer Systems Exposed the PHI of 31,000 Individuals

Acadiana Computer Services Inc., a Lafayette, LA-based provider of software and business solutions for the healthcare industry, has discovered an unauthorized individual has gained access to the email account of one of its employees.

The security breach was detected on July 6, 2018 and external access to the account was immediately disabled. An independent cybersecurity expert was retained to conduct a forensic analysis of the breach and determine the nature and scope of the attack.

An analysis of the emails in the compromised account revealed they contained the personal information of several of its clients’ patients. The information potentially accessed was limited to names, addresses, treatment information, billing information, and for a limited number of individuals, Social Security numbers.

The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 31,151 individuals have had their protected health information exposed as a result of the email account breach.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

Those individuals had previously received medical services from the following healthcare providers

  • Radiology and Interventional Associates of Metairie
  • LSU Healthcare Network
  • LSU Health Sciences Center Shreveport
  • Poly Ryon (Oakbend) Medical Group
  • Oceans Acquisition, Inc.
  • South Louisiana Medical Associates
  • Southern Surgical
  • Truman Medical Centers
  • University Hospital and Clinics
  • University of South Alabama
  • Willis-Knighton Medical Center

Acadiana Computer Services is sending notification letters to all individuals whose protected health information was potentially accessed and is providing further information on the steps they can take to monitor and protect their personal information.

Out of an abundance of caution, Acadiana Computer Services is covering the cost of identity monitoring services for all affected patients.

Acadiana Computer Services has already taken steps to reduce the risk of further breaches, which include augmenting email account security, retraining staff, and reviewing and updating its policies and procedures.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.