Skip to main content

Nixon Peabody LLP

  • People
  • Capabilities
  • Insights
  • About
Trending Topics
    • People
    • Capabilities
    • Insights
    • About
    • Locations
    • Events
    • Careers
    • Alumni
    Practices

    View All

    • Affordable Housing
    • Community Development Finance
    • Corporate & Finance
    • Cybersecurity & Privacy
    • Entertainment & Media
    • Environmental
    • Franchising & Distribution
    • Government Investigations & White Collar Defense
    • Healthcare
    • Intellectual Property
    • International Services
    • Labor, Employment, and Benefits
    • Litigation
    • Private Wealth & Advisory
    • Project Finance
    • Public Finance
    • Real Estate
    • Regulatory & Government Relations
    Industries

    View All

    • Aviation
    • Cannabis
    • Consumer
    • Energy
    • Financial Services
    • Healthcare
    • Higher Education
    • Infrastructure
    • Manufacturing
    • Nonprofit Organizations
    • Real Estate
    • Sports & Stadiums
    • Technology
    Value-Added Services

    View All

    • Alternative Fee Arrangements

      Developing innovative pricing structures and alternative fee agreement models that deliver additional value for our clients.

    • Continuing Education

      Advancing professional knowledge and offering credits for attorneys, staff and other professionals.

    • Crisis Advisory

      Helping clients respond correctly when a crisis occurs.

    • DEI Strategic Services

      Providing our clients with legal, strategic, and practical advice to make transformational changes in their organizations.

    • eDiscovery

      Leveraging law and technology to deliver sound solutions.

    • Environmental, Social, and Governance (ESG)

      We help clients create positive return on investments in people, products, and the planet.

    • Global Services

      Delivering seamless service through partnerships across the globe.

    • Innovation

      Leveraging leading-edge technology to guide change and create seamless, collaborative experiences for clients and attorneys.

    • IPED

      Industry-leading conferences focused on affordable housing, tax credits, and more.

    • Legal Project Management

      Providing actionable information to support strategic decision-making.

    • Legally Green

      Teaming with clients to advance sustainable projects, mitigate the effects of climate change, and protect our planet.

    • Nixon Peabody Trust Company

      Offering a range of investment management and fiduciary services.

    • NP Capital Connector

      Bringing together companies and investors for tomorrow’s new deals.

    • NP Second Opinion

      Offering fresh insights on cases that are delayed, over budget, or off-target from the desired resolution.

    • NP Trial

      Courtroom-ready lawyers who can resolve disputes early on clients’ terms or prevail at trial before a judge or jury.

    • Social Impact

      Creating positive impact in our communities through increasing equity, access, and opportunity.

    • Women in Dealmaking

      We provide strategic counsel on complex corporate transactions and unite dynamic women in the dealmaking arena.

    1. Home
    2. Insights
    3. Articles
    4. HIPAA enforcement against ACE shows need for proper structuring

      Articles

    Article

    HIPAA enforcement against ACE shows need for proper structuring

    July 9, 2025

    LinkedInX (Twitter)EmailCopy URL

    By Valerie Montague, Meredith LaMaster and Grace Connelly

    OCR’s recent settlement with an affiliated covered entity (ACE) serves as a reminder to entities using or considering the ACE structure of how OCR pursues enforcement against ACEs.

    On July 7, 2025, the US Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a $225,000 financial settlement and two-year corrective action plan (CAP) with Deer Oaks—The Behavioral Health Solution, a provider of psychological and psychiatric services to long-term care and assisted living residents (Deer Oaks). The March 19, 2025 Resolution Agreement describes Deer Oaks as an affiliated covered entity (ACE) under HIPAA, which means that it is comprised of multiple HIPAA covered entities that are under common ownership or control and which self-designate as an ACE.

    Complaint, breach, and investigation into alleged ePHI disclosure

    In December 2021, OCR received a complaint alleging that one of the covered entities within the Deer Oaks ACE impermissibly disclosed electronic protected health information (ePHI) through patient discharge summaries that were publicly accessible online due to a coding error. OCR commenced an investigation in May 2023 and determined that the ePHI of 35 individuals was exposed and cached by search engine providers from December 2021, if not earlier, until May 2023.

    During the course of this investigation, Deer Oaks notified OCR of a network data breach caused by a compromised account, impacting 171,871 individuals. Notably, although a key finding in OCR’s investigation of Deer Oaks is the lack of an accurate and thorough security risk analysis, OCR does not cite this enforcement action as falling within its Risk Analysis Initiative, likely because OCR also found that Deer Oaks impermissibly disclosed PHI.

    Importance of “living” security risk analysis

    In an email release describing the enforcement, OCR Director Paula M. Stannard stated that “common deficiencies” OCR sees through its Security Rule enforcement efforts include a lack of a security risk analysis or an organization’s failure to update its risk analysis when it implements new technologies or expands operations that affect the security of the organization’s electronic protected health information.

    While HIPAA-regulated entities should ensure that they are conducting an annual security risk analysis, it also is important to ensure that this analysis is updated, as necessary, if the organization adopts environmental or operational changes that impact the security of ePHI, which is a HIPAA regulatory requirement. 

    Considerations for affiliated covered entities

    As many healthcare providers operate within systems with other healthcare providers under common control or ownership, this enforcement serves as a reminder to take care when considering self-designation as an ACE and, if choosing to self-designate, to consider the liability surrounding the ACE. 

    For example, the HIPAA regulations state that a covered entity participating in an ACE is jointly and severally liable for a civil monetary penalty for a HIPAA violation of the ACE, unless it is established that another ACE member was responsible for the violation. Similarly, the Deer Oaks settlement is between OCR and the ACE. 

    When structuring an ACE, the entities involved may decide to internally segment that potential liability, contractually or otherwise. The possibility of joint and several liability also emphasizes the need for strong HIPAA compliance across the ACE, such as through a unified compliance program. 

    Practices

    HealthcareHealthcare Regulatory & ComplianceHealth Information - Privacy, Security & Data Sharing

    Industries

    Healthcare

    Insights And Happenings

    • Alert

      Supreme Court limits FCC authority in TCPA civil enforcement cases

      July 7, 2025
    • Alert

      Rhode Island enacts Medical Spas Safety Act

      July 2, 2025
    • Article

      Navigating Tariffs and False Claims Act Risk in the Healthcare Supply Chain

      June 25, 2025
    The foregoing has been prepared for the general information of clients and friends of the firm. It is not meant to provide legal advice with respect to any specific matter and should not be acted upon without professional counsel. If you have any questions or require any further information regarding these or other related matters, please contact your regular Nixon Peabody LLP representative. This material may be considered advertising under certain rules of professional conduct.

    Subscribe to stay informed of the latest legal news, alerts, and business trends.Subscribe

    • People
    • Capabilities
    • Insights
    • About
    • Locations
    • Events
    • Careers
    • Alumni
    • Cookie Preferences
    • Privacy Policy
    • Terms of Use
    • Accessibility Statement
    • Statement of Client Rights
    • Purchase Order Terms & Conditions
    • Nixon Peabody International LLC
    • PAL
    © 2025 Nixon Peabody. All rights reserved