Official Admits Portland Didn’t Initially Follow Proper Protocols In Disclosing Patients’ Information

A Portland official acknowledged Tuesday that the city did not initially follow proper protocols before sharing the protected personal health information of more than 200 HIV-positive patients with researchers at the University of Southern Maine. “Although USM’s researchers’ original written assurance that they would protect such information did not include all of the language required in a HIPAA business associate agreement, the city and USM promptly corrected that technical deficiency by executing a fully HIPAA-compliant business associate agreement,” City Hall Communications Director Jessica Grondin said in a written statement Tuesday evening. Two former patients at a city-run clinic and two doctors who worked there have accused the city of violating the Health Insurance Portability and Accountability Act, or HIPAA, which is intended to protect the privacy of personal health information.