Center for Autism and Related Disorders

Center for Autism and Related Disorders (CARD) notified patients that a third-party billing vendor incorrectly sent invoices containing unrelated patient information due to a computer error. Affected data included patient name, internal reference number, and payment history. No SSN, address, or financial account numbers were exposed. The error was fixed, and additional controls were implemented.

Center for Autism and Related Disorders, LLC (TX healthcare provider) reported to HHS OCR on 2023-02-04 that an employee of its business associate misdirected paper mail containing PHI of 634 individuals to the wrong recipients. PHI involved included names, claims information, and diagnoses. The covered entity notified HHS and affected individuals and worked with the BA to implement additional technical safeguards. Note: HHS web description states a BA employee was responsible, although the structured 'business associate present' flag on the OCR row is recorded as 'No' — flagged for human review.

Center for Autism and Related Disorders reported to HHS on 2020-10-16 a Hacking/IT Incident affecting 1440 individuals. Breached information located on Email. Employees were victims of an email phishing attack exposing ePHI including names, addresses, phone numbers, dates of birth, diagnoses, and health insurance information. The entity notified HHS, individuals, and media, and strengthened security safeguards.

Center for Autism and Related Disorders (CARD) notified patients of a data security incident affecting limited patient health information, including contact details, date of birth, diagnosis/treatment info, and insurance details. No evidence of misuse was found. CARD implemented additional security safeguards and offered 12 months of identity theft protection via IDX.