Two former patients and two doctors at the Portland-run India Street Public Health Center in Maine accused the city of violating the Health Insurance Portability and Accountability Act (HIPPA), which is intended to protect the privacy of patients’ health information.  City Hall Communications Director, Jessica Grondin, acknowledged that the city shared personal health-related information of more than 200 HIV-positive patients with researchers at the University of Southern Maine (USM).Grondin stated on Tuesday, “Although USM’s researchers’ original written assurance that they would protect such information did not include all of the language required in a HIPAA business associate agreement, the city and USM promptly corrected that technical deficiency by executing a fully HIPAA-compliant business associate agreement.”

Image Courtesy of SourceSecurity.com US Edition

USM had been looking to conduct a survey designed to solicit feedback regarding each HIV-positive patient’s experience in finding new medical providers after the city closed its Positive Health Care program in 2016.  Portland had decided to transition a federal grant for the Ryan White HIV Positive Health Care to the Portland Community Health Center, which is now Greater Portland Health.  Patients begged for the preservation of the clinic, but the council moved forward anyway.  A city analysis showed that only 33 of the 229 patients moved to Greater Portland Health, which was fewer than expected.A follow-up letter sent to patients Nov. 11 indicated that HIPAA law allows the city to share protected health information without patient consent for the purposes of research or program evaluation, provided that researchers ensure the confidentiality.  However, the patients and physicians who accused the city said that written permission should have been obtained prior to any disclosure.The two doctors involved in the case also accused the city of insufficiently responding to patient concerns regarding receiving care at the facility, and a former patient, who is part of a group overseeing the survey, pushed back against Portland’s assertion that the group was fully informed of its plans to pass along the information.  According to Grondin, city attorneys had advised staff to not give interviews.  “We are not going to do interviews,” Grondin said. “The information we sent you speaks for itself.”Mayor Ethan Strimling said he is a supporter of USM’s research, but wants to ensure that the patients’ concerns are also being addressed.  “I feel like doing the survey was very important,” Strimling said. “I want to find out what happened to the patients who were there.  I hope we can figure out a way to make this work for the patients and the researchers going forward.”The city initially suspended the survey after receiving two formal complaints.  Then, following an investigation, it entered into a new agreement with USM that included additional privacy protections. The survey is now moving forward and is expected to be completed next month.The U.S. Department of Health and Human Services, in addition to state attorneys general, have the authority to investigate improper patient information disclosures, negotiate settlements and impose penalties if necessary. The severity of the repercussions depends on the nature and circumstances of the violation, but fines can easily be in the millions.

Sources:

HIV patients accuse city of violating privacy by giving out personal data without noticeOfficial admits Portland didn’t initially follow proper protocols in disclosing patients’ information