A Behavioral Health Provider Put Discharge Summaries Online. It Cost $225,000: The Deer Oaks Settlement

Not every HIPAA violation involves a hacker. Some involve a document that was simply left where anyone could find it. The Deer Oaks settlement is the second kind, and it is a reminder that OCR enforces accidental exposure with the same seriousness it applies to ransomware, especially when the data involved is as sensitive as behavioral health records.

What happened

Deer Oaks, known as The Behavioral Health Solution, provides psychological and psychiatric services to residents of long-term care and assisted living facilities. As a healthcare provider that creates, receives, maintains, and transmits protected health information, it is a HIPAA covered entity subject to the full Privacy and Security Rules.

OCR opened its investigation in May 2023 after receiving a complaint. The allegation was specific: Deer Oaks had made patient discharge summaries publicly accessible online. Those summaries were not empty forms. They contained patient names, dates of birth, patient identification numbers, the facilities where patients received care, and their diagnoses.

For a behavioral health provider, a diagnosis is among the most sensitive pieces of information a patient has. Making that information publicly reachable, alongside the identifiers needed to tie it to a specific person, is precisely the kind of disclosure the Privacy Rule exists to prevent.

The two findings

OCR's resolution reflects two distinct problems, and both are instructive.

The impermissible disclosure. The core violation was the public exposure of the discharge summaries. This is worth dwelling on because it upends a common assumption. Many organizations think of HIPAA enforcement as something that follows a cyberattack, an external adversary breaking in. But there was no attacker here. The information was disclosed because it was placed, or left, somewhere the public could reach it. HIPAA does not require malice or intrusion for an impermissible disclosure to occur. The exposure itself is the violation.

The risk analysis deficiency. As in nearly every OCR action of the past two years, the agency also pointed to risk analysis. OCR has repeatedly described the same pattern in its investigations: entities that lack a risk analysis entirely, or that fail to update it when they add new technologies or expand operations. A proper, current risk analysis is designed to catch exactly this kind of exposure, by forcing an organization to map where its PHI lives and to ask whether any of it is reachable by people who should not see it.

The corrective action plan

Deer Oaks paid $225,000 and agreed to a corrective action plan that OCR will monitor for two years. The plan is a template of what OCR now expects from every organization it settles with:

Review and update the risk analysis annually to determine the risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI. Develop and implement a risk management plan to address the risks the analysis identifies. Maintain and revise written HIPAA policies and procedures as needed. And provide annual HIPAA training to every workforce member with access to PHI.

There is a pattern in these corrective action plans worth internalizing: they are not punishments so much as descriptions of the compliance program the organization should have had all along. Every requirement in the plan is something the Security Rule already expected.

Why this case matters: two lessons

Accidental public exposure is fully enforceable. The most important takeaway is that you do not need to be breached to be penalized. A misconfigured server, an unsecured page, a document store reachable without a login, a patient portal that exposes more than it should, any of these can put PHI in public view, and any of them can produce an enforcement action. Organizations that pour all their attention into defending against external attackers while leaving their own systems publicly reachable are defending one door while leaving another wide open.

Behavioral health data raises the stakes. The sensitivity of the information amplifies everything. Behavioral health diagnoses carry real risks of stigma and discrimination, and their exposure can cause profound personal harm. Providers in this space should treat any potential exposure as high-severity, and should be aware that some of their data, particularly substance use disorder records, may carry additional protections under 42 CFR Part 2, which OCR began enforcing in 2026.

What to do now

Test your systems for unauthenticated public access. For every system that holds PHI, verify that none of it can be reached from the public internet without a login. This includes patient-facing portals, document stores, internal tools that may be inadvertently exposed, and any pages that serve documents like discharge summaries.

Store sensitive documents in access-controlled systems only. Discharge summaries, assessments, and similar documents should live in systems that require authentication and enforce access controls, never on public pages or unsecured file locations.

Put public-exposure scenarios in your risk analysis. A risk analysis that only considers external attackers is incomplete. It must also ask whether your own systems expose PHI to people who should not see it. Public reachability is a vulnerability like any other.

Give behavioral health data heightened protection. If you handle mental health or substance use information, apply your strongest controls, confirm whether Part 2 applies to any of your records, and treat any exposure as a high-severity incident.

The takeaway