OCR settles phishing attack investigation, with provider paying $480,000

​This agency’s first data breach settlement under HIPAA for a phishing attack involved the alleged failure to conduct a risk analysis to identify potential ePHI threats or vulnerabilities across the Lafourche Medical Group network.