Medical info improperly disclosed by Multnomah County Corrections
Health care staff at Multnomah County's jails improperly disclosed medical information of hundreds of patients with mental illness.
Prior to sharing the protected information with staff from a diversion court program, corrections health staff didn't confirm whether or not patients had provided consent or if a court ordered the information disclosable.
Such disclosures are a violation of the Health Insurance Portability and Accountability Act (HIPAA), which has set patient privacy standards nationally since 1996.
Patients' names, dates of birth, photo, medical record number, diagnoses, medications and treatment information may have been disclosed, according to a post on the county's website Friday, Aug. 5.
The oversight affected 351 people, officials said. The disclosures occurred between Sept. 3, 2019, and June 6, 2022, when a corrections health manager noticed the issue, said Julie Sullivan-Springhetti, spokesperson for the county.
In some cases, patients' information also was disclosed to patients' defense counsel or the Multnomah County Circuit Court, officials said.
Officials said they believe there is a "low to moderate" risk to the patient's information because the information was disclosed either to county staff, the patient's attorney or court staff.
Multnomah County is notifying the "patients so they are fully informed of what happened and what they can do next," the post read. "The county has policies and procedures for disclosing personal information, and those policies are being reviewed with staff involved in this incident."
Corrections health staff sent the information via email to staff from the county health department's Behavioral Health Forensic Diversion program, officials said. The program connects people with mental illness who have been charged with crimes to treatment, working to keep them out of jail or the Oregon State Hospital.
The disclosures were to coordinate "aid and assist" services, which are designed to help people participate in their legal defense if their mental illness is too severe for them to be part of a trial, officials said.
The improper disclosures appear to have occurred when diversion program staff requested medical information from corrections health staff without including necessary documents to show the information was releasable, Sullivan-Springhetti said. Corrections health staff then provided the information anyway.
An investigation into the disclosures is ongoing, Sullivan-Springhetti said.
"Although the information was shared for purposes of serving the clients," Sullivan-Springhetti said, their consent or a court order "should have been confirmed to be in place" prior to the information's disclosure.
"Once we have completed our investigation, forensic diversion and corrections health staff will receive re-training, coaching, or other follow-up as deemed appropriate," Sullivan-Springhetti said.
The county is offering free identity theft protection services to all patients through IDX, a data breach and recovery service, according to county officials. The county also is offering a $1 million insurance reimbursement policy and fully managed identity theft recovery services.
Patients who have questions should contact 1-800-939-4170 or go to app.idx.us/account-creation/protect.
You count on us to stay informed and we depend on you to fund our efforts. Quality local journalism takes time and money. Please support us to protect the future of community journalism.