Multnomah County has begun notifying Corrections Health patients that their personal information may have been disclosed to the Health Department’s Behavioral Health Forensic Diversion staff for the purposes of coordinating services without proper authority.
Between approximately Sept. 3, 2019 and June 6, 2022, Corrections Health staff disclosed medical information by email to Health Department Behavioral Health Forensic Diversion staff for the purpose of coordinating Aid & Assist services. This information was for individuals who were participating in the program to receive services to help them be able to aid and assist in their legal defense.
For some of these patients, Corrections Health has not been able to confirm whether a Release of Information (ROI) or Court Order was in place before personal information was disclosed during this time period.
Patient name, date of birth, photo, medical record number, diagnoses, medications, and treatment information may have been disclosed to Forensic Diversion. In some cases, personal information disclosed was re-disclosed to the patient's defense counsel or the Multnomah County Circuit Court.
Multnomah County is notifying 351 Corrections Health patients so they are fully informed of what happened and what they can do next. The County has policies and procedures for disclosing personal information, and those policies are being reviewed with staff involved in this incident.
After completing its internal review, identifying the patients affected and establishing services to support those patients, Multnomah County Health Department has begun sending letters notifying all patients whose information was disclosed.
Because the information was disclosed to either to county staff or to the patient’s attorney or Court staff for the purpose of coordinating Aid & Assist services, the County believes there is a low to moderate risk to the individual patient’s information.
The County is offering free identity theft protection services to all patients through IDX, a data breach and recovery service. IDX identity protection services include 12 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed ID theft recovery services.
Patients who have questions should contact 1-800-939-4170 or go to app.idx.us/account-creation/protect for assistance.