Multnomah County employee forwards health info. to personal account for more than 3 years
For more than three years a Multnomah County health department employee automatically forwarded emails from the employee’s county account to a personal account, the county said Friday.
Some of the emails contained the personal health information of residents that’s protected by law. But after it conducted an investigation, the county said it believed no one’s personal information was accessed and the risk was low that anyone’s information went beyond the employee’s personal account.
The county discovered what was happening Nov. 16, 2016 during a routine audit. It found the employee had been automatically forwarding the emails to a Google account since Aug. 24, 2012.
The county said the following information may have been disclosed: First and last name, medical record number, medication name, prescription number, diagnosis, date of service and or age.
There was no evidence Social Security numbers, addresses, or phone numbers were also disclosed, the county said.
“We are not aware of any other inappropriate uses or disclosures of your personal information,” the county said in a news release.
County spokeswoman Jessica Morkert-Shibley said she couldn’t comment on whether the employee was disciplined because it was a personnel matter. For the same reason she said she couldn’t comment on what the employee’s motivation may have been.
“We have policies and procedures for handling personal information which were reviewed with the staff member involved in this incident,” the county said in its news release. “We are also reviewing controls, business practices and policies to increase protections of personal information in response to this incident. We sincerely regret any inconvenience or worry this incident presents to you.”
The county said it is committed to keeping people's personal information private.
For people who have concerns about this, the county asks them to call it at 1-877-422-7676, option 1 and reference case #1322.