A federal agency that enforces patient-privacy rules says that Portland did not violate federal law when it shared sensitive patient information with researchers.

Portland, which closed its HIV Positive health care program in 2017, asked USM to survey patients to ensure that they could continue getting the medical help they needed.

A former patient at the city’s now-closed HIV Positive health care program asked the U.S. Department of Health and Human Services last year to investigate whether the city violated patients’ privacy when it gave researchers at the University of Southern Maine’s Muskie School of Public Service the names and contact information for more than 200 patients without their consent.

The city had asked the university to conduct a survey of the former patients to ensure that they were able to get the medical help they needed after the city closed its HIV program nearly two years ago. Some former patients were shocked, upset and confused when they received a survey from USM in the mail in November of 2017, since they were not asked or told about it in advance.

After apologizing for failing to inform former patients about the survey, city officials admitted that they did not follow proper protocol when they shared the information with the university researchers. The city’s initial agreement with USM didn’t have all of the language required under a law protecting the confidentiality of health information. The city described it as a “technical deficiency” and entered into a modified federally compliant agreement with USM researchers shortly after receiving the complaint.

Portland’s actions were enough to satisfy the DHHS Office of Civil Rights, according to a determination dated Jan. 2.

“Based on our review of the facts and circumstances of these matters, we have determined that the matters raised in this complaint have been resolved by the voluntary actions of Portland,” Regional Manager Susan M. Pezzullo Rhodes said in the letter. “OCR is closing this case and will take no further action.”

Portland closed the HIV clinic in 2017 after a federal grant that funded the program was transferred to Greater Portland Health, a nonprofit, federally qualified health center in Maine’s largest city. A city analysis showed that only 33 patients followed the funding to Greater Portland Health.

Patients and advocates were concerned about how the closure would impact the 229 patients and their access to medical care, such as STD testing, primary health care, specialized HIV care and psychiatric care, which were once available under one roof at the city’s India Street Public Health Center.

Since the clinic treated people who were HIV positive, some former patients and former medical providers at the clinic were outraged when protected health information was disclosed without patient permission or advance notice. They were concerned that the act of providing names to researchers would reveal their sensitive medical conditions.

Portland resident Jenson Steel, a former patient at the clinic, filed a complaint in December 2017 with the Maine Attorney General’s Office, which determined that the city complied with the state’s HIV confidentiality statute. The AG referred Steel to the Office of Civil Rights in Boston to address potential violations of the federal Health Insurance Portability and Accountability Act, or HIPAA, which are outside of the state’s purview.

Steel filed a federal complaint last February. Steel said he was unable to get answers about his inquiry until he contacted the office of Rep. Chellie Pingree, Maine’s 1st District congresswoman.

“My reaction to the ruling is neutral, but the fact the city tried to evade and shift responsibility for sharing the names and addresses still burns, as does the clinic’s closing,” Steel said this week.

It’s unclear when or if the city will move forward with the survey, to which only 30 of the 229 affected patients initially responded.

Steel serves on a patient advisory committee established by the city to oversee the closure of the clinic. The group meets again later this month to discuss next steps, he said.

A city spokeswoman said that the city was pleased with the OCR ruling, which it was still reviewing before determining how to proceed.

“The city has maintained from the beginning that there was no breach of patient privacy and that it has complied with applicable laws,” City Hall Communications Director Jessica Grondin said. “The fact that the Maine Attorney General’s Office and now the federal Office of Civil Rights have both reviewed the city’s actions and confirmed that fact is certainly welcome news. We continue to review the decision and will have more information in the near future regarding the next steps for the assessment.”

Randy Billings can be reached at 791-6346 or at:

rbillings@pressherald.com

Twitter: randybillings