Center for Autism and Related Disorders

Center for Autism and Related Disorders (CARD) notified patients that a third-party billing vendor incorrectly sent invoices containing unrelated patient information due to a computer error. Affected data included patient name, internal reference number, and payment history. No SSN, address, or financial account numbers were exposed. The error was fixed, and additional controls were implemented.

Center for Autism and Related Disorders, LLC (TX healthcare provider) reported to HHS OCR on 2023-02-04 that an employee of its business associate misdirected paper mail containing PHI of 634 individuals to the wrong recipients. PHI involved included names, claims information, and diagnoses. The covered entity notified HHS and affected individuals and worked with the BA to implement additional technical safeguards. Note: HHS web description states a BA employee was responsible, although the structured 'business associate present' flag on the OCR row is recorded as 'No' — flagged for human review.