OCAT, LLC dba Evoke Wellness at Hilliard Data Breach — Official Case File

From the AG filing description

OCAT, LLC, doing business as Evoke Wellness at Hilliard, operates as a specialized behavioral health and addiction treatment facility providing residential and outpatient care. Because of the critical medical and psychiatric services they deliver, entities in this sector collect and maintain vast repositories of exceptionally sensitive documentation. This includes comprehensive intake forms, detailed medical histories, clinical psychiatric evaluations, substance use treatment records, billing information, and government-issued identification numbers necessary for insurance verification and patient intake management. The continuous collection of this deeply personal information is essential for patient care, but it simultaneously transforms the facility into a high-value target for cybercriminals seeking to exploit vulnerable medical networks. In 2025, OCAT, LLC dba Evoke Wellness at Hilliard reported a significant security incident to the Massachusetts Attorney General, signaling a breakdown in administrative and technical safeguards. While the exact vector of the compromise—whether driven by unauthorized intrusion into clinical databases, a targeted ransomware deployment, or an exploited third-party vendor vulnerability—continues to be examined, incidents affecting healthcare providers typically stem from unpatched software vulnerabilities, compromised employee credentials, or sophisticated phishing campaigns. When threat actors successfully penetrate these networks, they frequently gain unrestricted access to internal file servers containing unencrypted patient files and administrative records, leaving individuals exposed without their knowledge or consent. The exposure of behavioral health and medical data carries profound and long-lasting consequences for affected individuals. Unlike a stolen credit card, which can be easily canceled and replaced, deeply personal health information—such as diagnostic details, treatment dates, prescription histories, and Social Security numbers—cannot be altered. This sensitive combination of data opens victims up to severe risks, including targeted medical identity theft, where fraudsters obtain unauthorized treatment under a victim's name, falsify medical records, or insurance fraud that can compromise future healthcare coverage. Furthermore, the public disclosure of addiction treatment or mental health records introduces devastating risks of social stigma, emotional distress, and professional repercussions. As a healthcare provider handling protected health information, OCAT, LLC dba Evoke Wellness at Hilliard was bound by stringent legal and regulatory frameworks, most notably the Health Insurance Portability and Accountability Act (HIPAA) Security and Privacy Rules, alongside state-level data protection statutes. These laws mandate the implementation of rigorous administrative, physical, and technical safeguards, including comprehensive data encryption, multi-factor authentication, regular vulnerability assessments, and continuous network monitoring. The occurrence of a data breach of this magnitude serves as a strong indicator that the organization may have failed to maintain these required security standards, leaving confidential patient records vulnerable to unauthorized extraction and exploitation. Receiving a data breach notification letter from OCAT, LLC dba Evoke Wellness at Hilliard is a formal acknowledgment that your private medical and personal information was compromised due to inadequate data security. Legally, this notification establishes your standing to participate in a class action lawsuit aimed at holding the facility accountable for failing to protect your statutory privacy rights. Under applicable legal principles, victims are not required to demonstrate immediate financial loss or direct identity theft to seek justice; the unauthorized exposure of your sensitive data alone constitutes a compensable injury. Our law firm handles these complex data privacy cases on a contingency fee basis, meaning you pay no upfront costs or out-of-pocket expenses, and we only collect a fee if we successfully recover compensation on your behalf.