Maine government website displayed mental health patients’ confidential information
Maine government website displayed mental health patients’ confidential information
Matthew Stone
by Matthew Stone
April 28, 2021
Click to share on Twitter (Opens in new window)Click to share on Facebook (Opens in new window)Click to share on Reddit (Opens in new window)Click to print (Opens in new window)Click to email this to a friend (Opens in new window)
The Maine Department of Health and Human Services offices on State Street in Augusta, shown in this December 2017 file photo. Credit: Darren Fishell / BDN
A state agency displayed confidential information about patients of Maine mental health and addiction treatment agencies and group home residents on a public website, a Bangor Daily News review found.
At least 20 documents on the Maine government website contained names and, in some cases, addresses, dates of birth and phone numbers, for those receiving mental health and substance use treatment. The website is a public database where anyone can review licensing information for health care agencies overseen by the Maine Department of Health and Human Services.
The documents, all from 2013, 2014 and 2015, included reports of patients’ violent and suicidal behavior, descriptions of situations that landed patients in the hospital, and some patients’ and family members’ complaints about health care providers.
00:00
07:19
Touring a Roofing Shingle Plant
One document, for example, detailed a female’s allegation of a sexual assault at a mental health crisis facility, identifying the person who alleged the assault by name and birthdate. It also noted that she tested positive for a medication she had been prescribed weeks before and described where she received treatment.
It’s unclear how the documents came to appear on a public website, but the information they contained can’t be publicly disclosed without patients’ consent under federal health care privacy rules.
A DHHS spokesperson didn’t answer questions from the BDN about how the information ended up there, how long it had been available and whether the department would inform affected patients and health care providers.
A Bangor Daily News editor discovered the documents while reviewing the database, accessed through the Maine Department of Professional and Financial Regulation’s website. That portion of the website was disabled after the BDN alerted DHHS about the confidential information.
“As soon as DHHS became aware that this information was available through a search of a public database, we took immediate action to remove it and launched a review to determine how this occurred and the appropriate next steps,” DHHS spokesperson Jackie Farwell said. “We take the protection of private health information seriously and are committed to a comprehensive and timely review.”
The database contains information about more than 250 licenses for health care providers authorized as mental health and substance abuse agencies. The documents with confidential information could be accessed through links that were supposed to lead to summaries of state inspections of the health care facilities.
“That is a real unfortunate breach of HIPAA-protected personal information,” said Malory Otteson Shaughnessy, executive director of the Alliance for Addiction and Mental Health Services, which represents a number of Maine mental health and substance use treatment providers.
HIPAA, the Health Insurance Portability and Accountability Act, is the federal law that limits the disclosure of sensitive patient information without patients’ consent. Maine law also protects the confidentiality of medical records, and federal law provides for even stricter confidentiality for patients receiving substance use treatment.
“There’s still a lot of stigma around substance use. There’s still a lot of stigma around mental health,” Shaughnessy said. “If an employer learns of something happening with an employee, it can have reverberations on their job. It can have a lot of different impacts.”
Laws also prohibit the disclosure of people’s status as beneficiaries of public benefit programs, such as the housing choice voucher, which was disclosed in at least one document in the state database.
“It’s a definite breach,” said Bonnie-Jean Brooks, president and CEO of OHI, which operates group homes for adults with intellectual disabilities in the Bangor area.
Some of the documents detail the complaints patients or family members made to DHHS’ licensing division. Others are critical incident reports that health care providers must file with the state when patients in their care are harmed or when providers make errors such as administering the wrong medication.
Banks Don't Want You To Know This
SPONSORED CONTENT
Banks Don't Want You To Know This
By BritFinanceNews
One critical incident report, for example, details a group home resident’s damage to the facility after refusing to take medications. Another reads, “We do not have any information other than [client name] shot himself.”
The document includes the client’s name and date of birth.
The public disclosure of such information can put group home residents at risk by potentially allowing dangerous people in their lives to find out details about them, Brooks said.
Matthew Stone
by Matthew Stone
April 28, 2021
Click to share on Twitter (Opens in new window)Click to share on Facebook (Opens in new window)Click to share on Reddit (Opens in new window)Click to print (Opens in new window)Click to email this to a friend (Opens in new window)
The Maine Department of Health and Human Services offices on State Street in Augusta, shown in this December 2017 file photo. Credit: Darren Fishell / BDN
A state agency displayed confidential information about patients of Maine mental health and addiction treatment agencies and group home residents on a public website, a Bangor Daily News review found.
At least 20 documents on the Maine government website contained names and, in some cases, addresses, dates of birth and phone numbers, for those receiving mental health and substance use treatment. The website is a public database where anyone can review licensing information for health care agencies overseen by the Maine Department of Health and Human Services.
The documents, all from 2013, 2014 and 2015, included reports of patients’ violent and suicidal behavior, descriptions of situations that landed patients in the hospital, and some patients’ and family members’ complaints about health care providers.
00:00
07:19
Touring a Roofing Shingle Plant
One document, for example, detailed a female’s allegation of a sexual assault at a mental health crisis facility, identifying the person who alleged the assault by name and birthdate. It also noted that she tested positive for a medication she had been prescribed weeks before and described where she received treatment.
It’s unclear how the documents came to appear on a public website, but the information they contained can’t be publicly disclosed without patients’ consent under federal health care privacy rules.
A DHHS spokesperson didn’t answer questions from the BDN about how the information ended up there, how long it had been available and whether the department would inform affected patients and health care providers.
A Bangor Daily News editor discovered the documents while reviewing the database, accessed through the Maine Department of Professional and Financial Regulation’s website. That portion of the website was disabled after the BDN alerted DHHS about the confidential information.
“As soon as DHHS became aware that this information was available through a search of a public database, we took immediate action to remove it and launched a review to determine how this occurred and the appropriate next steps,” DHHS spokesperson Jackie Farwell said. “We take the protection of private health information seriously and are committed to a comprehensive and timely review.”
The database contains information about more than 250 licenses for health care providers authorized as mental health and substance abuse agencies. The documents with confidential information could be accessed through links that were supposed to lead to summaries of state inspections of the health care facilities.
“That is a real unfortunate breach of HIPAA-protected personal information,” said Malory Otteson Shaughnessy, executive director of the Alliance for Addiction and Mental Health Services, which represents a number of Maine mental health and substance use treatment providers.
HIPAA, the Health Insurance Portability and Accountability Act, is the federal law that limits the disclosure of sensitive patient information without patients’ consent. Maine law also protects the confidentiality of medical records, and federal law provides for even stricter confidentiality for patients receiving substance use treatment.
“There’s still a lot of stigma around substance use. There’s still a lot of stigma around mental health,” Shaughnessy said. “If an employer learns of something happening with an employee, it can have reverberations on their job. It can have a lot of different impacts.”
Laws also prohibit the disclosure of people’s status as beneficiaries of public benefit programs, such as the housing choice voucher, which was disclosed in at least one document in the state database.
“It’s a definite breach,” said Bonnie-Jean Brooks, president and CEO of OHI, which operates group homes for adults with intellectual disabilities in the Bangor area.
Some of the documents detail the complaints patients or family members made to DHHS’ licensing division. Others are critical incident reports that health care providers must file with the state when patients in their care are harmed or when providers make errors such as administering the wrong medication.
Banks Don't Want You To Know This
SPONSORED CONTENT
Banks Don't Want You To Know This
By BritFinanceNews
One critical incident report, for example, details a group home resident’s damage to the facility after refusing to take medications. Another reads, “We do not have any information other than [client name] shot himself.”
The document includes the client’s name and date of birth.
The public disclosure of such information can put group home residents at risk by potentially allowing dangerous people in their lives to find out details about them, Brooks said.
