Following a Department of Health and Human Services' Office for Civil Rights (OCR) investigation of a complaint about a case of impermissible disclosure of PHI, St. Luke's-Roosevelt Hospital Center Inc. has paid OCR $387,200 to resolve potential HIPAA compliance violations In September 2014, a complaint was submitted to the OCR about a possible privacy violation involving a patient of St. Luke's Spencer Cox Center for Health. In the complaint that was submitted, it was alleged that a member of St Luke's staff violated the privacy of a patient by faxing protected health information to the person's employer. The information contained in the fax was highly sensitive, including the patient's sexual preference, HIV status, sexually transmitted diseases, mental health diagnosis, details of physical abuse experienced, medical care and medications being taken.