Private Medical Records Compromised by County Health Worker

An employee of the Multnomah County Health Department regularly forwarded all of her work emails to her private Gmail account, inadvertently compromising the medical information of individuals. Some of the emails included first and last name of patients, their medical record number, what medications they were taking, prescription number, diagnosis, date of service, and/or age.

The breach was discovered in a random audit on November 22, 2016 but only disclosed this week.

"We have not found any indication that your social security number, address or phone number was included," the county said in a statement. "Because none of the messages in the employee’s personal email account appear to have been accessed, we believe there is a low risk that your information was further disclosed.

"However, the personal email account is maintained by Google and not the county. We are not aware of any other inappropriate uses or disclosures."

The county did not say how many records were compromised or whether the employee had been disciplined. They did say that she has received training to understand privacy protections.

The county said that if anyone has questions they can call 877-422-7676, press #1 and reference case 1322.

Image via ShutterStock