Mental Health Provider Fined $225K for Lack of Risk Analysis

A Texas mental healthcare provider’s failure to conduct a comprehensive risk analysis resulted in a $225,000 federal fine after regulators investigated an accidental data leak followed by a ransomware attack in 2023.

See Also: Top 10 Technical Predictions for 2025

HHS’ Office for Civil Rights said Monday that San Antonio, Texas-based Deer Oaks Behavioral Health also must implement a corrective action plan and undergo two years of monitoring by HHS OCR under the resolution agreement.

Deer Oaks, founded in 1992, provides psychological and psychiatric services to residents of long-term care and assisted living facilities.

The settlement resolves an investigation HHS OCR launched in May 2023 after receiving a complaint that Deer Oaks impermissibly disclosed patients’ electronic protected health information on discharge summaries that were publicly accessible via the internet. That exposed ePHI affected 35 patients, including their names, dates of birth, patient identification numbers, facilities and diagnoses.

Deer Oaks told HHS OCR investigators a coding error in a now discontinued pilot program for an online patient portal caused the data exposure. The mishap resulted in ePHI being exposed and cached by search engines from at least December 2021 to May 19, 2023, HHS OCR said.

But that complaint was just the beginning of HHS OCR’s HIPAA investigation into Deer Oaks. The federal agency said it expanded its scrutiny of Deer Oaks in July 2024 after the mental healthcare provider experienced a hacking incident on its IT network on Aug. 29, 2023, stemming from a compromised account.

Cybercriminals claimed to have exfiltrated data and demanded Deer Oaks pay a ransom to prevent posting patients’ information on the darkweb. Settlement documents do not indicate whether Deer Oaks paid the ransom.

Deer Oaks reported the breach to HHS OCR on July 31, 2024, as affecting 171,871 people (see: Ransomware Attack on Mental Health Provider Affects 172,000).

Risk Analysis Failure

HHS OCR said its investigation into both incidents found that Deer Oaks failed to conduct an accurate and thorough security risk analysis, as required under HIPAA.

“Identifying potential risks and vulnerabilities to ePHI is a key step in preventing or mitigating breaches of protected health information,” said Paula Stannard, HHS OCR director in a statement.

The settlement with Deer Oaks is at least HHS OCR’s 10th enforcement action spotlighting faulty HIPAA risk analysis since the agency named risk analysis as a top enforcement priority in October 2024.

“Based on OCR’s experience enforcing potential HIPAA Security Rule violations, the covered entity or business associate under investigation will often have deficient risk analysis practices,” Stannard said.

“Common deficiencies include lacking a risk analysis entirely or failing to update existing risk analyses when implementing new technologies, or expanding operations that affect the security of ePHI.”

Under the corrective action plan, which HHS OCR will monitor for two years, the mental healthcare provider has agreed to:

• Annually review and update as necessary its risk analysis to determine the potential risks and vulnerabilities to the confidentiality, integrity and availability of its ePHI;
• Develop and implement a risk management plan based on the findings of its risk analysis;
• Develop, maintain and revise as necessary written policies and procedures to comply with the HIPAA Rules;
• Provide annual HIPAA training for each Deer Oaks workforce member who has access to PHI.

Deer Oaks did not immediately respond to Information Security Media Group’s request for comment on its settlement with HHS OCR.

The resolution agreement says the settlement is not an admission of liability by Deer Oaks, nor a concession by HHS OCR that the healthcare provider is not in violation of the HIPAA rules and not liable for civil money penalties.

The Deer Oaks settlement is HHS OCR’s 17th HIPAA enforcement action so far in 2025. Six settlements were announced under the Biden administration, and the 11 under the Trump administration.