Lakewood, Colo.-based NAS Recovery Solutions disclosed a data breach affecting up to 7,000 current and former clients after workforce members downloaded client information without authorization, The HIPAA Journal reported July 23.
The organization learned May 13, 2026, that the workforce members had copied limited client information, including first and last names, dates of birth and telephone numbers. Because NAS Recovery Solutions provides substance use disorder treatment and behavioral health services, the organization said it could be inferred that the affected individuals were receiving substance use disorder treatment.
NAS Recovery Solutions said its investigation found no indication that any other information was obtained. The breach notice did not disclose why the information was downloaded, according to the report.
The organization said it has reviewed workforce access and security controls, implemented additional safeguards, provided workforce training on HIPAA and patient privacy, and taken corrective action against the workforce members involved. The notice did not disclose the sanctions imposed.
At the Becker's Fall Behavioral Health Summit, taking place November 4–5 in Chicago, behavioral health leaders and executives will explore strategies for expanding access to care, integrating services, addressing workforce challenges and leveraging innovation to improve outcomes across the behavioral health continuum. Apply for complimentary registration now.