Behavioral Health Provider to Pay $225,000 Over Privacy Breach

The Department of Health and Human Services’ Office for Civil Rights has settled with Deer Oaks, a behavioral health provider, resolving potential health privacy violations involving impermissible disclosure of electronic protected health information, OCR announced Monday.

OCR’s investigation found that Deer Oaks failed to conduct an accurate and thorough risk analysis to identify potential risks and vulnerabilities to the protected health information it held. This led to two incidents where the data was improperly disclosed—one in which patient discharge summaries were publicly accessible online due to a coding error and another in which a hacker accessed and threatened to ...