OCR Fined a Post-Acute Provider $182,000 for What It Said About Patients

OCR Fined a Post-Acute Provider $182,000 for What It Said About Patients

On September 30, 2025, the HHS Office for Civil Rights announced a HIPAA settlement with Cadia Healthcare Facilities. The settlement was for $182,000. The corrective action plan runs two years. The specific violation was not a ransomware event, not a laptop left in a car, not a phishing attack. It was marketing content — patient "success stories" on a public-facing website, complete with names, photographs, and clinical detail — posted without valid HIPAA authorizations from about 150 patients.

That is worth a home health, home care, and hospice operator's undivided attention. The OCR HIPAA settlement 2025 post-acute line of enforcement is not about your firewall. It is about what your agency says out loud, in public, about the people you care for. This piece walks through what OCR actually found, what the corrective action plan requires, and what it means for how post-acute agencies talk about patients on their website, on social media, in email, in newsletters, and — quietly, less obviously — on the phone.

This is general regulatory information, not legal advice.

What OCR Found

According to the OCR press release, a complaint was received in September 2021. OCR's investigation concluded that Cadia had posted patient "success stories" on its public website, including names, photographs, and details about treatment and recovery, without obtaining valid HIPAA authorization from the patients themselves. Roughly 150 patients had their PHI disclosed this way. OCR concluded the disclosures violated the HIPAA Privacy Rule and that the failure to notify affected individuals violated the Breach Notification Rule.

The corrective action plan requires Cadia to:

• Review and revise its HIPAA policies and procedures;
• Provide workforce training on HIPAA — with specific focus on marketing personnel;
• Notify all affected individuals whose PHI had been posted online or in marketing materials without proper authorization;
• Operate under a two-year monitoring period with OCR.

OCR's director framed the point plainly: before disclosing PHI through social media or public-facing websites, covered entities and business associates should confirm the Privacy Rule permits the disclosure, and generally a valid written authorization is required before posting an individual's PHI in a website testimonial or a social media campaign.

Why This Is a Post-Acute Story, Not a Marketing Story

It is tempting to file this away as a marketing team problem. That would be the wrong lesson. Three things about the fact pattern generalize directly to home health, home care, and hospice operations:

• Post-acute providers rely heavily on emotional referral marketing. The whole category — recovery, homecoming, families reunited — creates continuous pressure to tell patient stories. That pressure is exactly what generates unauthorized-disclosure risk.
• The Privacy Rule does not carve out testimonials. There is no "if it's a positive story" exception. If PHI is identifiable and the disclosure isn't for treatment, payment, or operations, HIPAA requires a valid authorization — a specific one, not the general consent tucked into intake paperwork.
• The disclosure surface is bigger than the website. Newsletters, LinkedIn posts, video testimonials, Google reviews the agency solicited, recorded calls used in training decks, the sales team quoting a patient to a referral partner — all of these are potential Privacy Rule disclosures.

What Counts as a Valid HIPAA Authorization for Marketing

HIPAA authorization is not the same as the general "acknowledgement of privacy practices" you collect at admission. For marketing uses of PHI, the authorization must be written; it must describe the PHI to be used or disclosed with specificity; it must name the person authorized to make the disclosure and the person to whom the disclosure will be made; it must state the purpose; it must have an expiration date or event; it must be signed by the individual (or personal representative) and dated; and it must contain the notice of the right to revoke.

Marketing authorizations have an additional wrinkle. Under 45 CFR 164.508(a)(3), most marketing uses of PHI require an authorization that also states whether the covered entity is receiving direct or indirect remuneration from a third party. That is a detail that a plain "I consent to share my story" form typically misses.

Translating that into an operational rule: a patient nodding when a marketing coordinator asks "can we use your story?" is not a valid HIPAA authorization. Neither is a general publicity release drafted for a corporate context. If the paperwork does not have the elements above, the disclosure is unauthorized.

What This Means for the Phone

The Cadia case involved website content, but the underlying rule — you cannot disclose PHI without a valid authorization or a Privacy Rule permission — is broader than any one channel. Post-acute agencies routinely generate PHI-adjacent content on the phone that ends up in places the Privacy Rule cares about:

• Recorded calls being clipped and used in sales training materials shared outside the covered entity.
• Testimonial calls being repurposed as podcast content or promotional videos.
• Discharge conversations used, without authorization, in a "how we handled a tough case" newsletter feature.
• Family testimonial calls invited via IVR prompt and quoted on the website.

Any of these can create the Cadia fact pattern in miniature. If you have a call recording system — and if you handle healthcare calls at scale, you do — the audit question you should be asking is not "are these recordings secure." It is "who has authority to move a recording out of the compliance archive and into a piece of external content, and what authorization documentation do we require before they do?" That was the process failure at the heart of the Cadia settlement.

A Post-Cadia Checklist for Post-Acute Operators

1. Audit the Website

Read every patient story on your public site. For each one, identify the underlying HIPAA authorization: who signed it, when, what specific PHI it covers, when it expires. If you cannot produce the authorization, take the story down and notify the individual.

2. Audit the Feeds

Do the same for the last 24 months of social media posts, LinkedIn content, and email newsletters. Marketing platforms retain content — OCR investigators can find it.

3. Rewrite the Consent Path

Replace generic "publicity releases" with a HIPAA-compliant marketing authorization that meets 164.508's requirements. If you cannot articulate whether direct or indirect remuneration is involved, get compliance counsel to write the form.

4. Train the Marketing Team Specifically

The Cadia CAP called out marketing training for a reason. General HIPAA training aimed at clinical staff does not cover the specific rules for marketing uses of PHI. Split the curriculum.

5. Reconcile the Recording Archive

Make an inventory of every downstream use of recorded calls — training decks, sales demos, testimonial reels, executive presentations. For each one, identify the authorization or the Privacy Rule permission. This is the same discipline we've written about in Why HIPAA-aligned voice AI is no longer optional and in 94% of Small HIPAA Breaches Aren't Hacks. They're People.

Reference: Common Marketing Uses of PHI and Their Status

Use	Requires HIPAA authorization?	Notes
Named patient story on website with photo	Yes	Center of the Cadia fact pattern
De-identified story with all HIPAA identifiers stripped	Generally no	Verify against 45 CFR 164.514
Video testimonial	Yes	Voice and image are identifiers
Google review the agency solicited from a patient	Yes, if PHI is included	Solicitation itself may implicate marketing rules
Recorded call clip used in external sales demo	Yes	Even if voice is altered, other identifiers remain
Aggregate outcomes ("our patients had X% recovery")	No, if truly aggregate and de-identified	Do not include unverified statistics

Where SurfacerIQ Fits

SurfacerIQ is call and interaction intelligence for healthcare contact centers. In the context of this OCR trend, the category of capability that matters is the audit trail on recorded calls: who accessed which recording, what happened after, and whether an authorization was on file. That is the discipline that turns a call archive from a Cadia-style liability into a compliance asset.

The Point

The OCR HIPAA settlement 2025 post-acute line — Cadia is one case; there will be more — should reset how home health, home care, and hospice operators think about marketing. Not because the marketing content is dishonest. Because HIPAA does not care whether the story is flattering, sincere, or clinically accurate. It cares whether the patient authorized the disclosure in a form that meets 164.508. Everything else is enforcement risk.

If you want to talk through what a Cadia-style audit of your own agency's public content and call archive would look like, talk to us.

General regulatory information for post-acute operators. Not legal advice. Consult your HIPAA counsel about the specific requirements of a compliant marketing authorization and about any content already in the public domain.