DPH compliance office reports fewer disallowances, rising incident reports and concern about unauthorized access

Garrett Chatfield, acting director of the Office of Compliance and Privacy Affairs (OCPA), gave the commission an annual report on compliance, privacy and whistleblower activity.

On compliance, Chatfield said the department recorded no fines and paid just over $300,000 in disallowances this fiscal year — an improvement compared with multi‑million disallowances several years ago. OCPA completed 28 audits covering roughly 222 claims; the behavioral health CBO space had an average error rate of about 11% (down from 13%), with substance use services showing higher error rates that are improving.

On privacy, Chatfield said reported incidents have risen as internal reporting improved and that about 31% of reported incidents qualified as reportable breaches this year. He singled out unauthorized access as "by far the largest" privacy pain point and said OCPA plans to explore automated privacy monitoring software to augment manual access reviews. Chatfield also described efforts to centralize memoranda of understanding and to strengthen contract language for data sharing.

Chatfield reviewed the whistleblower process: DPH submitted 144 complaints to the Controller's Office last year; those are triaged and only a subset are assigned for OCPA investigation. He noted training efforts and internal mitigation work and invited commissioners to use the hotline and the Controller's Office for reporting concerns.

During Q&A commissioners asked about AI‑assisted voice transcription and privacy safeguards; Chatfield said contracts, IT and compliance review each system to ensure technical safeguards and contractual protections for protected health information.