Montgomery County accidentally disclosed personal health information in responding to Right-To-Know request

The Montgomery County Office of Public Health mistakenly disclosed unredacted personal health information after a request was submitted under the Right-to-Know Law seeking data about cases of COVID-19 and exposure at schools, the county announced Friday.

The Right-to-Know request was made with the county’s Office of Open Records on March 1, seeking data from September 2020 to November 2020.

Instead of providing the requester with redacted information, the county said in a statement Friday, the Office of Public Health inadvertently provided students’ personal information, including their names, dates of birth, schools, and COVID test results — information that is protected from disclosure under the federal HIPAA law. Information about school staff members also was released.

Social Security numbers were not disclosed, the county said.

On March 15, the county sent the information, but it did not become aware of the mistake until May 21. It has since conducted an investigation, identified the recipient, and requested that the file be deleted.

According to the statement issued Friday, the county has also taken a strong look inward to prevent such mistakes from happening again.

“As part of the mitigation efforts, the county has reviewed its policies around this issue and [is] in the process of making necessary revisions to them. The county is also in the process of reviewing its training materials to ensure that any needed additions or clarifications are implemented to avoid such incidents in the future,” the statement said.

Montco officials have notified all affected residents, the statement said, as well as the U.S. secretary of Health and Human Services, as is required by law in such cases.