Notice of Data Event at Boutin Jones
Crestwood Behavioral Health, Inc. and Helios Healthcare LLC, (collectively, “CBHI”) are sharing information about a data security incident at one of its outside law firms, Boutin Jones, that is impacting information related to certain CBHI clients and employees. This notice explains the event, the measures that have been taken, and steps potentially affected individuals may take in response.
We at CBHI are committed to protecting the privacy and dignity of those we serve. While this incident occurred outside of our systems, it involved information entrusted to a partner working on our behalf. We are treating this matter with care, urgency, and transparency.
What Happened
On May 30, 2025, CBHI was notified by one of its outside law firms, Boutin Jones, that Boutin Jones suffered a cybersecurity incident on October 15, 2024. Upon receiving this notification, CBHI immediately contacted Boutin Jones to learn more about the incident and its impact on individuals associated with CBHI. CBHI also began working with outside legal counsel who are experts in cybersecurity matters to ensure that it was taking the proper steps in response to this incident.
Through additional communications with Boutin Jones, CBHI learned that Boutin Jones suffered a ransomware incident on October 15, 2024, where certain documents were exfiltrated from the Boutin Jones network. Further information regarding the incident and the steps taken by Boutin Jones can be found at the following link: https://boutinjones.com/wp-content/uploads/Boutin-Jones-Notifies-Affected-Individuals-of-Information-Security-Incident36521236.1.pdf
What Information Was Involved
CBHI conducted a review of potentially impacted documents in Boutin Jones’ possession to determine what, if any, protected information was impacted, and to whom the information related. On July 10, 2025, CBHI completed its review of files provided by Boutin Jones and determined the total scope of information impacted relating to CBHI employees and to CBHI clients. For CBHI clients, the information varies by individual but may include name, date of birth, medication and diagnosis information, lab results, patient identification numbers, vital signs, and clinical photographs.
What Boutin Jones Is Doing
Boutin Jones mailed notice letters to impacted individuals on July 21, 2025, where address information was available. These notice letters provide impacted individuals with additional information relating to the event and with complimentary access to credit monitoring for twelve (12) months through Equifax.
For individuals seeking additional information regarding this event, please contact the Boutin Jones toll-free dedicated assistance line at 833-594-5297. The response line is available Monday through Friday, 9:00 am to 9:00 pm, Eastern Time.
What You Can Do
CBHI encourages potentially impacted individuals to remain vigilant against identity theft and fraud, to review account statements, and to monitor their credit reports and explanation of benefits forms for suspicious activity. Boutin Jones is providing potentially impacted individuals with contact information for the three major credit reporting agencies, as well as providing advice on how to obtain free credit reports and how to place fraud alerts and security freezes on their credit files. The relevant contact information is below:
Equifax
P.O. Box 105069
Atlanta, GA 30348
1-888-298-0045
Experian
P.O. Box 9554
Allen, TX 75013
1-888-397-3742
TransUnion
P.O. Box 2000
Chester, PA 19016
1-833-799-5355
Potentially impacted individuals may also find information regarding identity theft, fraud alerts, security freezes and the steps they may take to protect their information by contacting the credit bureaus, the Federal Trade Commission or their state Attorney General. The Federal Trade Commission can be reached at: 600 Pennsylvania Avenue NW, Washington, DC 20580; www.identitytheft.gov; 1-877-ID-THEFT (1-877-438-4338); and TTY: 1-866-653-4261.
Instances of known or suspected identity theft should also be reported to law enforcement or the individual’s state Attorney General.
Our Commitment
At Crestwood, we understand how unsettling this kind of incident can be. We view privacy as a cornerstone of care. We are working hard to make sure those affected are informed, supported, and protected.