Office of Compliance Program at LSU (nocompliance@lsuhsc.edu)I reported a HIPAA violation to the LSU HIPAA compliance office by email on June 17, 2014. They did not reply to me, but instead released a fabricated story to the press which was published on August 19, 2014 and thereafter, falsely accusing me of "hacking" their servers and demonstrating this "hack" in class. My employer was then requested to censure me for this falsely alleged criminal activity. This was vicious and dishonest retaliation against me for reporting the original HIPAA violation.
Larry H. Hollier, MD, FACS, FACC, FRCS (Eng.), Chancellor of LSU (lhholl@lsuhsc.edu)
Dr. Arthur Q. Tyler , Chancellor of CCSF (atyler@ccsf.edu)
Carmen Lamha, Department Chair of CNIT at CCSF (clamha@ccsf.edu)
Craig Persiko, Department Chair of CS at CCSF (cpersiko@ccsf.edu)
California Governor Jerry Brown (https://govnews.ca.gov/gov39mail/mail.php)
Lousiana Governor Bobby Jindal (http://www.gov.louisiana.gov/index.cfm?md=form&tmp=email_governor)
Times-Picayune (@nolanews)
San Francisco Chronicle (@sfgate)
The Register (@TheRegister)
Ars Technica (@arstechnica)
I did not "hack" anything, or "demonstrate" anything in a class--I was not even teaching any classes at this time. The allegations are baseless, false, and libelous.
I did two things: I performed a Google search to find the exposed patient data, and I sent one email to three recipients at LSU to inform them of the HIPAA violation.
HIPAA, in addition to requiring LSU to protect their patient's data, specifically forbids them from retaliating against me for filing a HIPAA complaint.
I have therefore filed an official HIPAA Complaint with the US Health and Human Services Office for Civil Rights, including the PDF file linked below which details the entire timeline of events.
Details of LSU Retaliation (PDF)
Here is my Complaint Form Confirmation: