Jenson Steel, a former patient at Portland’s HIV Positive Health Clinic, filed a complaint last week with federal regulators about possible violations of patient privacy laws when the city shared HIV patients’ names with researchers. He also asked the city to suspend the research until regulators issue a ruling.

A former patient at a city-run health clinic has formally asked federal regulators to determine whether Portland officials violated privacy laws by sharing the names and contact information of more than 200 HIV-positive patients with university researchers without patient consent.

Jenson Steel, a former patient at the city’s HIV Positive Health Clinic and member of the Patient Advocacy Committee, said he filed a complaint last Thursday with the U.S. Department of Health and Human Services’ Office of Civil Rights. He and other members of the committee have asked the city to halt the research until the office issues a ruling.

“We decided that until we have a ruling on any (privacy) violations that everything should just stay frozen,” Steel said.

Only 30 of the 229 patients responded to a survey that researchers circulated using the contact information provided by the city. City Hall Communications Director Jessica Grondin said city officials are respecting the request of the Patient Advocacy Committee to put the analysis of the survey responses on hold.

“We are working with the Patient Advocacy Committee on the next steps, but for now, even though we did not violate patient privacy, there is no further action being taken on the survey at this time,” she said.

The federal complaint comes after the Maine Attorney General’s Office concluded that the city complied with the state’s HIV confidentiality statute, because the disclosure was for the limited purpose of research and approved by the University of Southern Maine’s Institutional Review Board. However, the Attorney General’s Office, which reviewed the process at Steel’s request, does not have the authority to rule on potential violations of the federal Health Insurance Portability and Accountability Act, and concerned patients were referred to the federal DHHS Office of Civil Rights.

“With respect to federal statutes, it was determined the disclosures were likely subject to the HIPAA Privacy Rule,” Melissa O’Neil, the AG’s executive assistant, said in a Feb. 5 email.

An official with the Office for Civil Rights said in an email that the agency does not comment on current or potential investigations.

CITY WON’T RELEASE STAFF RECORDS

A public records request filed by the Portland Press Herald in December produced little insight into the rationale behind the city’s decision to move forward with transferring the information to USM, despite being warned of potential privacy concerns.

The Press Herald requested all communications sent or received by city officials and USM researchers regarding the survey, and the list of employees involved in the process. The city has so far withheld those records, effectively citing confidentiality of personnel information.

“To the extent that any records exist that contain complaints of misconduct or information that may lead to discipline, those documents are confidential and not subject to disclosure,” Grondin said in a written response. “The city does not have a non-confidential document listing the names of city employees involved in coordinating the survey with USM. Further, the findings of the city’s investigation of complaints relating to the survey are privileged and confidential.”

The Press Herald is continuing to seek city communications about the survey.

Julie Sullivan, a senior adviser to the city manager, had been overseeing the survey, but Steel said she was taken off the project and the Patient Advocacy Committee is now working with Dawn Stiles, director of the city’s Health and Human Services Department.

Grondin said in an email that no employee has been disciplined as a result of the patient information disclosure.

The list of patients and their contact information was provided to researchers at USM’s Muskie School of Public Service, who were asked to survey former patients about whether they have been able to receive care for a variety of medical needs – including STD testing, primary health care, specialized HIV care and psychiatric care – that were once available under one roof at the city’s India Street Public Health Center.

The clinic closed in 2017 after a federal grant that funded the program was transferred to Greater Portland Health, a nonprofit, federally qualified health center in Portland. A city analysis showed that only 33 patients followed the funding to Greater Portland Health.

Some former patients and former medical providers at the clinic were outraged when protected health information was disclosed without patient permission. They were concerned that the act of providing names to researchers would reveal their sensitive medical conditions.

CONFLICTING CLAIMS ON NOTICE TO PATIENTS

One of the health care officials, Dr. Ann Lemire, former medical director at the India Street clinic, has said she warned the city in September that it should not be sharing the list of patients with a third party, because doing so would violate federal patient privacy laws.

The survey, which USM mailed to patients in November, reopened old wounds for many patients, who had developed strong relationships with staff at the city program and pleaded with city councilors over the course of several public hearings not to shutter the clinic, which was doing nationally recognized work.

The city claims the Patient Advocacy Committee was informed that the city intended to share the patient names and contact information with USM, which would deliver the survey results to the city in a way that did not identify patients. However, committee members disputed that claim, saying that they were assured by Sullivan, the adviser to the city manager, that the city would be contacting the patients.

“It is a travesty that these same patients were again mistreated by the city of Portland,” said Joey Brunelle, who advocated for saving the city clinic where his former partner was a patient. “This could have been prevented – warnings were ignored. The city had a moral and legal responsibility to protect these patients and their sensitive information, and it failed them. There ought to be consequences when something like this happens.”

CITY ADMITS A ‘TECHNICAL DEFICIENCY’

City officials have emphasized that they did not need to get patient consent, because state and federal laws allow such disclosures for research purposes. They also stress that no “breach” has occurred.

However, the federal Health Insurance Portability and Accountability Act requires a formal business associate agreement to be in place before protected health information is shared with researchers.

After the city apologized for not communicating better with patients about the impending survey, Grondin admitted that the city did not have a fully executed business associate agreement with USM when the patient information was shared. She described it as “technical deficiency.”

“Although USM’s researchers’ original written assurance that they would protect such information did not include all of the language required in a HIPAA business associate agreement, the city and USM promptly corrected that technical deficiency by executing a fully HIPAA-compliant business associate agreement,” Grondin said in a written statement Dec. 12.

Randy Billings can be contacted at 791-6346 or at:

rbillings@pressherald.com

Twitter: randybillings