A St. Louis nonprofit that provides mental health care and counseling is facing a class action investigation after telling state regulators that an intruder accessed patient records. Attorneys announced the probe on September 8, days after Provident Behavioral Health filed a breach report with Massachusetts regulators on September 4.
Suspicious activity surfaced on the organization’s systems on April 3, and a forensic review later confirmed that an unauthorized user acquired data stored on the affected machines. What was exposed varies by individual, but the mix leans heavily on identity and medical records, with Social Security numbers included for many patients. The affected population also takes in clients of Care and Counseling, a practice that merged into Provident in 2023.
Notices went out by mail starting June 4, and the nonprofit is providing credit monitoring and identity restoration services. It has not disclosed how many people are affected. Investigators are examining whether the organization took reasonable steps to safeguard records that included sensitive behavioral health information.
