On August 15, 2025, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a $225,000 settlement with Deer Oaks – The Behavioral Health Solution regarding potential violations of the HIPAA Privacy and Security Rules. While we’re referencing publicly available information about the case, we do not know Deer Oaks’ internal processes or every security control they had in place. This article focuses on the practical lessons ABA providers can apply today.
What OCR Reported
According to OCR, two incidents triggered the investigation and settlement:
- Patient portal exposure (2021–2023): A pilot portal reportedly exposed discharge...
Check Out Our Other Articles
What ABA Providers Can Learn from Medicaid Cuts and HIPAA Settlements - Join us Live at 8:00 AM
North Carolina Medicaid Cuts: Why ABA Providers Must Act Now
Building Resilient ABA Businesses
Cutting Through Prior Authorization Red Tape: How SILNA Helps ABA Businesses Thrive
Join Us Live: Safeguards in ABA & California AB 951
Safeguards in ABA: Why In-Home Protections Cannot Be Overlooked
California Ends Mandatory Autism Re-Diagnosis for ABA Therapy Coverage: What AB 951 Means for Families and Providers
Building ABA Teams That Thrive (Part 2): Managing ABA Business Caseloads
Partners, Profits & Peace of Mind: Why Financial Clarity Matters More Than Ever for ABA Providers
Summer’s Not Over—But We’re BACK! (Join Us Live on Facebook Monday, August 4th at 8 AM Eastern)
Colorado RBT Requirements: What ABA Providers Are Actually Saying
Nebraska Medicaid Rate Cuts: What ABA Providers and Families Need to Know
Building ABA Teams That Thrive: Structure, Support & Culture!
Would You Rather: Real ABA Leaders Tackle the Tough Choices
New Tax Law, New Opportunities: What the OBBBA Means for ABA Providers
Prior Authorization Reform Highlights a System in Crisis—Silna Has the Solution for ABA Providers
AI Meets ABA: The Future of Behaviour Analysis with Adam Ventura
Finding Your Why: The Heart of ABA Business Ownership
Looking after your RBTs, Part 2: Knowing Your Worth
Silna: The Physician’s Perspective of Prior Authorizations
This Week in ABA News - Why Ethics Matter: ABA Insurance Mandates, Broken Trust, and the Real Work Ahead
When Trust Is Broken: What Every ABA Provider Must Learn from Recent Abuse Allegations
The Real Story on ABA Insurance Mandates: When Low Rates Undercut the Promise
This Week in ABA News: Prior Authorizations Under Fire and a Wake-Up Call from Kansas Schools
When Schools Ban ABA Therapists: Lessons From Kansas, and a Wake-Up Call for ABA Providers
RFK Jr., Dr. Oz, and the End of Prior Authorizations? What ABA Owners Need to Know
Real Talk for RBTs: Advocacy, Burnout & Building a Better Workplace
The Ethical CFO: Why Financial Leadership Is Every ABA Owner’s Responsibility (Even If You’re Small)
Play Is Productive: The Hidden Power of Play in ABA Business Ownership
This Week in ABA: Policy Shifts, Data Science, and Cybersecurity— Join us LIVE at 8 AM Eastern today!
Ransomware in ABA: What It Looks Like, How to Prevent It, and Smarter Email Security
Florida’s Sweeping Autism Law: What it Means for Families, ABA Providers, and the Future of Autism Services
The Autism Data Science Initiative: Why It Matters for ABA Providers and the Future of Autism Care
ABA Weekly: Lifelines, Benchmarks & Compliance—Join us Live at 8 AM Eastern
HIPAA in 2025: Why Every ABA Company Needs to Rethink Compliance—Now
The Real Benchmark: What HealthBench, AI, and ABA’s Future Mean for Kids
When Systems Fail Families, ABA Can Still Be a Lifeline
How to Improve ABA Supervision with Allyson Wharam of ‘ABA in the Field’
ABA Business Weekly: HIPAA, M&A, and Turning the Tide in Special Ed - Live at 8AM Eastern today!
HIPAA Breaches Aren’t Just a “Big Company” Problem: What ABA Businesses Need to Learn from the WellNow Settlement
Turning the Tide: How ABA Leaders Can Rebuild Trust in Special Education
Navigating the 2025 ABA M&A Surge: What Ethical Practice Owners Need to Know
Ego Driven Hiring: A Wake-Up Call for ABA Business Owners
Waiving Co-Pays and the Power of Partnership - Live New Today at 8 AM Eastern
NASQN & 3 Pie Squared Partner to Empower Ethical ABA Practice Growth
When Discounts Cross the Line: What ABA Practice Owners Need to Know About Waiving Deductibles
Clarity, Capacity, and Efficiency with Silna
Chaos, Contracts & Chatbots: What’s Really Steering ABA? - Live news today - 8 AM Eastern in Facebook
The Contract Temptation: Why Classifying BCBAs as 1099s May Be a Risk for ABA Companies
When Systems Fail Quietly: Optum, Medicare Fraud, and the ABA Fallout We Can’t Ignore
Whose Hand Is on the Wheel? What a Reddit AI Experiment Means for the Future of Clinical Judgment in ABA
Finding Joy in the Journey
Two Truths and a Wake-Up Call: Medicaid Cuts, Treatment Intensity, and the Future of ABA - Live discussion today at 8 AM Eastern
The Real Impact of Medicaid Cuts on ABA Therapy: What Providers and Families Need to Know
Quality Is a Choice: What Treatment Intensity Says About Who We Are in ABA
3 Things We Thought Would Be Easier!
Celebrating Mothers (and Everyone Else Who Deserves a Break): 50% Off the ABA Business Leaders Platform This Weekend Only!
Experts, X-Rays, and Indiana Drama: Live discussion today at 9:00 AM Eastern
Who Gets to Speak in ABA—and What Does That Say About Us?
Indiana Is Back in the News: What ABA Providers Need to Know About the State’s Latest Push for Cost Controls
How Applied Behavior Analysis Can Improve Healthcare Systems
Dealing with workplace drama!
🧩 Trends, Truths & Turning Points: What’s Shaping Autism and Behavioral Health in 2025
Arkansas Mom Releases Powerful Children’s Book on Autism and Mealtime Struggles
“What are we really doing here?”: The Push to Standardize Quality in Autism Therapy
Behavioral Health Deal Volume Up 53% in Early 2025: What This Means for ABA Practices
The Growing Gap in Autism and IDD Care: Why the Industry Must Scale Ethically and Strategically
Should a BCBA Always Own the Clinic? Maybe Not.
Staff, Tariffs, and RFK Jr.: What ABA Companies Need to Know Right Now - Live today at 8 AM Eastern!
ABA Staff Turnover Is Still Out of Control — Here’s What the Data Says
How the New Tariffs Could Impact ABA Businesses (And What You Can Do About It)
RFK Jr.’s Autism Registry Proposal: Understanding the Implications for ABA Companies
How Margin Keepers Can Help You Master Payroll & Financial Planning
Quality over Quantity- Is more supervision always better?
Denials, Audits & Billing Headaches: ABA News Roundup – April 14, 2025
Nebraska Issues New ABA Medicaid Service Definitions Amid Federal Audit Scrutiny
Concerns Grow Over Insurance Misuse of Medically Unlikely Edits (MUEs) in ABA Therapy Denials
Federal Audit Finds $56 Million in Improper Medicaid Payments for ABA Therapy in Indiana
UnitedHealthcare’s Strategy to Limit ABA Therapy Raises Alarm in the Autism Community
It’s Time to Get Real: ABA Business Owner Burnout
From Policy Shifts to Legal Hits: ABA News Roundup – April 7, 2025 - Live event today at 11AM Eastern!
Texas Recognizes QABA® for Behavior Analyst Licensure
Maryland Clinic Settles HIPAA Violations After Ransomware Attack
New York’s Proposed Medicaid Cuts Raise Concerns for Autism Services
Massachusetts Expands ABA Therapy Coverage to Children with Down Syndrome
Indiana’s Updated Medicaid Policy for ABA Therapy: What You Need to Know
Expanding to a Clinic? Do this first!
From Big Deals to Big Trouble: ABA Business News - March 31, 2025
The truth behind the client and staff cancellations
Top ABA Headlines
Local Owner Highlight- When to scale your ABA Business
Understanding the journey- Improving caregiver relationships with Melanie Thurston
How Effective Bookkeeping Ensures Payroll Stability and Helps You Retain ABA Staff
The Importance of Bookkeeping Services for ABA Business Owners
Mastering Marketing – Local Outreach Done Right
How to Scale Your ABA Business
You Just Closed Your ABA Company... Now What?
Building the Future of Small ABA Businesses – Join Us in This Mission
Red Flags in ABA Service Providers
Coaching Session- Discussing Onboarding with a New Owner
Would You Rather: Hiring in ABA
Grow your own BCBAs vs. hiring- What you need to know
Aligning Leadership with Values: Behavioral Intelligence in ABA with Dr. Paul Gavoni
ABA Accreditation: Compliance or Commitment to Quality?
AI meets clinical decision making- Using AI to improve patient outcomes- with Amanda Ralston
Comprehensive Updates to ABA Practice Handbooks: Enhanced Policies, Compliance, and ACQ Standards Integration
Leadership in ABA: Building Values, Managing Relationships, and Driving Progress with Martin Myers
Leadership, transparency, and collaboration in ABA organizations, with Jennifer Heidt
Building Better Care; Public Policy and Staff Empowerment
Free RBT Training for Your ABA Team This Holiday Season!
Innovating ABA Practice with AI Solutions
How can we help? Using ACT with Meg Solomon.
Building Resilience in ABA Practices: Lessons in Staffing, Billing, and Growth
Flash Sale: 6 Months Free Access to Our ABA Business Leaders Training Platform for 25 Companies!
I Hate My Job: Exploring Real Solutions
I Hate My Job: Reaction to Posts
I Hate My Job: Real Stories of Ethical Dilemmas in ABA
Introducing the New ABA Business Leaders Training Platform
I Hate My Job: Voicing the Frustrations of ABA Professionals
Introducing Our New Self-Paced Courses: Revenue Cycle Management & Effective Hiring with Indeed
CPABA Conference: A Path Forward for the Field - Get a 10% Discount!
Empower & Thrive: Registration Extended Until October 7 - 50% off!
Exciting New Coaching Opportunity for 3 Pie Squared ABA Business Leaders!
Free Download! Discover Essential Tax Compliance Tips with MarginKeepers
Why Stephen is Excited About the CPABA Conference 2024 - Discount just for you! -
3 Pie Squared Partners with Happy Medium RBT to Offer a Revolutionary 40-Hour RBT Training
Maximizing Recruitment with Indeed: How to Find the Right Candidates Without Breaking the Bank
Empathetic Leadership in ABA: Supporting Our Techs
Five Weeks of Wisdom: Bite-Sized Insights from 3 Pie Squared
Introducing the ABA Business Leaders Training Platform
Free Download! Boost Your Established ABA Practice with MarginKeepers' Essential Accounting Tips
Inside the World of ABA Audits and Legal Guidance with Kim Mack Rosenberg, Esq.
Ethical Practices for ABA Testimonials and Reviews with Dr. Jon Bailey
Navigating Growth and Challenges in ABA Business with Alecia Barrett
For a limited time, buy any of our handbooks and get our Business Leaders Membership for 75% off!
Collaboration in ABA: Strengthening Connections Among ABA Business Owners
"I Hate My Job" Series Kickoff: Discussing Burnout and Unethical Practices in the ABA Field
Top Five Essentials for Your Company Policies
Discount Ends Tomorrow – Last Chance to Get 20% Off Our Comprehensive ABA Billing Training Series!
Mastering Digital Marketing for ABA Practices with Reece from Reputation Elevation
Navigating ABA Business Growth: Consultation with Alecia Barrett
Unlock Your Billing Potential: Our New ABA Billing Course and Free ABA Billing Tips!
Navigating Company Policies: A Blueprint for ABA Practices
Free Chart of Accounts: Optimize Your Bookkeeping with MarginKeepers
Safeguarding Integrity: Proactive Strategies to Mitigate Billing Fraud in ABA Therapy
Steering Clear of Fraud: Mastering Insurance Billing in ABA Practice
From Overwhelm to Strategy: The Journey of an ABA Business Leader
Beyond the Startup: Common Mistakes by Seasoned ABA Business Owners
Essential Elements of an Employee Handbook for ABA Practices
Don’t Do That!: Avoiding Common Missteps in Your ABA Practice
Pre-Hire Power: The Critical Importance of an Employee Handbook for ABA Practices
Integrating Art into ABA Therapy: A Conversation with Natasha Bouchillon
Why a Client Handbook is Crucial Before Starting ABA Services
🥧 Grab a Slice of Success: Pi Day Flash Sale! 🎉
Why Should I Get a Client Handbook Before I Start Seeing Clients?
Financial Insights for ABA Practices: Free Chart of Accounts from MarginKeepers!
Navigating Authentic Copywriting in ABA Services: Insights and Innovations
Big Changes to the Podcast!
Get Free Expert Consulting for Your ABA Business on Our Podcast – Apply Now!
Navigating the Credentialing Conundrum: Insights from ABA Leaders
Navigating ADA Compliance: Essential Insights for ABA Business Owners
Nurturing Success: The Interplay Between Company and Team Dynamics
🌟 Dive Into the World of Sleep with Dr. Emily Ice: A Podcast Episode Not to Miss 🌜
A little late but our update is here!
Maximizing Your ABA Practice’s Potential: The Power of Bookkeeping with MarginKeepers
33% Off ABA Business Leaders for the Next 25 People!
Client Hours Discussion with April, Mallory Stinger, and Jennifer Helton
Improving Quality Through Accreditation: A Discussion with Erick Dubuque, Director of ACQ
Optimize Your ABA Practice with the Case Load Utilization Tool - 50% until Friday!
Black Friday Special - Rate Negotiations 2.0 - Elevating Your Practice with Provider Rate Resources
Navigating Medical Necessity with Dan and Mike from ABA on Tap
Upcoming Podcast with Erick Dubuque, Director of ACQ & Exciting News on How We Can Help Companies Navigate This New Standard! 🌟🎙️
Partnering with MarginKeepers, Co.: A Game Changer for Your ABA Practice
Celebrate Canadian Thanksgiving with a Bang: 50% Off ABA Business Leaders Membership and Earn 33.5 CEUs!
Empowering Change: Insights from New BCBA Business Owners
Founding a Nonprofit Practice with Susan Habchy
ABA Business Amazon List
De-Stress & Avoid ABA Burnout with a Relaxing Post-Work Routine
Three Common Struggles of a New ABA Practice
Benefits of Outsourcing with 3 Pie Squared
Why 3 Pie Squared
The Essential List for a Successful Business
2019 Satisfaction Survey results
The Cost of RBT Turnover
What You Need to Know About HIPAA
Podcast with Dr. Becca Tagg
Run Your Therapy Business Like a Well-Oiled Machine!
How to Grow Your Practice
- summaries and initial assessments online, allowing some ePHI to be indexed by search engines and viewed publicly.
- Cybersecurity breach (August 2023): A compromised account allegedly led to data exfiltration and a large breach notification.
OCR found that the organization had not conducted an accurate and thorough HIPAA risk analysis . The resolution included a corrective action plan and a monetary settlement. Again, we can’t speak to Deer Oaks’ internal decision-making ; we’re drawing general compliance lessons for ABA providers.
Why This Matters to ABA Providers
ABA practices handle highly sensitive information: diagnoses, treatment plans, schedules, caregiver details, and more. A single misconfiguration or compromised account can expose families to harm and put your practice at legal and reputational risk. Beyond fines and investigations, trust is on the line.
Risk Analysis vs. Pen Testing: You Likely Need Both
HIPAA requires a documented risk analysis that maps where electronic protected health information (ePHI) lives, how it flows, and what could go wrong. In practice, that analysis should be paired with technical validation like penetration testing or vulnerability scanning to uncover real-world weaknesses.
- Risk analysis: Identifies your ePHI assets, data flows, threats, likelihood/impact, and current controls; produces a prioritized risk management plan.
- Pen test/scans: Validate the analysis by actively probing for misconfigurations, exposed endpoints, weak authentication, and privilege issues.
When systems change—new portals, telehealth tools, EHR integrations—your risk analysis should be updated and your technical testing repeated.
Practical, ABA-Specific Safeguards
- Inventory ePHI: List every system handling ePHI (EHR, billing, file shares, email, portals, backups) and the data moving between them.
- Access controls & MFA: Enforce least-privilege access and require multi-factor authentication for admin and remote accounts.
- Audit & alerts: Turn on logging; review access logs; alert on unusual downloads, off-hours access, or bulk exports.
- Secure portals: Gate portals behind proper auth, disable indexing, use robots controls, and test for public exposure.
- Encryption: Encrypt ePHI in transit and at rest (email, storage, backups, mobile devices).
- Vendor management: Maintain BAAs; verify vendors’ security posture and SOC/HITRUST claims.
- Incident readiness: Have a written plan for containment, forensics, notices, and recovery; rehearse it.
- Staff training: Provide role-based HIPAA and security training; include phishing simulations and privacy workflows.
How 3 Pie Squared Can Help (With a Discount for Customers)
3 Pie Squared now offers HIPAA consultations with our security expert. We tailor support to ABA operations so you get practical steps you can actually implement:
- Risk Analysis Support: Map ePHI locations and data flows, identify vulnerabilities, and prioritize remediation.
- Risk Management Plan: Clear, staged actions with owners and timelines that fit ABA workflows.
- Policy & Procedure Review: Align written policies with how your systems and staff actually work.
- Training Guidance: Role-based training plans for clinicians, billing teams, and admins.
- Security Testing Referrals (optional): Introductions to vetted partners for penetration testing and scanning.
Existing 3 Pie Squared customers receive a 10% discount on HIPAA consultations.
Key Takeaways
- HIPAA risk analysis is not optional —and it must be updated when your systems change.
- Validate with testing —pair documentation with technical checks to catch real exposures.
- Portals and pilots need scrutiny —test for public access, caching, and indexing before go-live.
- Prepare for incidents —logging, alerts, and a practiced response plan limit damage.
- Train the team —human error is still the top attack vector; keep training practical and frequent.
Next Steps
If you’re unsure where your ePHI sits, whether your risk analysis is current, or how to prioritize fixes, we’re here to help. Our goal is to be a partner—give you clarity now, support implementation, and, when you’re ready, train our replacement so you can run sustainably.
Disclosure: This article summarizes public statements from HHS OCR and general HIPAA requirements. We do not have insight into Deer Oaks’ internal security practices beyond those public statements. Nothing here is legal advice.
