May 9—If you are experiencing a mental health crisis, call the Maine Crisis Hotline at 888-568-1112.
Confidential information about patients receiving mental health and addiction treatment services was available on a Maine government website for more than three months, a state Department of Health and Human Services spokesperson said Friday.
At least 20 documents on the state government website contained names and, in some cases, addresses, dates of birth and phone numbers, for those receiving mental health and substance use treatment, the Bangor Daily News found last month.
The documents, all from 2013, 2014 and 2015, included reports of patients' violent and suicidal behavior, descriptions of situations that landed patients in the hospital, and some patients' and family members' complaints about health care providers.
The reports were available on the government website from Dec. 15, 2020, until April 26, 2021, the day a BDN editor alerted DHHS to the confidential information, DHHS spokesperson Jackie Farwell said. A review found that the documents ended up on the website due to "an electronic system error," she said.
"We are not aware of any misuse of this information, which did not include Social Security, credit card, or insurance information," Farwell said.
Many of the documents were critical incident reports that health care providers must file with the state when patients in their care are harmed or when providers make errors such as administering the wrong medication.
One report detailed a group home resident's damage to the facility after refusing to take medications. Another read, "We do not have any information other than [client name] shot himself." A third detailed a female's allegation of a sexual assault at a mental health crisis facility.
The documents were available through a public database where anyone can review licensing information for health care agencies overseen by the Maine DHHS. The agency cut off access to that section of the database when it became aware of the confidential information. It has since restored access, and the confidential documents are no longer available on the website.
The state agency is now tracking down contact information for the approximately 20 people identified in the documents so they can be notified of the disclosure, Farwell said.
"While DHHS is not required by law to make these notifications, we take the protection of confidential information seriously and seek to make affected individuals aware," she said.
Going forward, Farwell said, the agency has applied "an additional layer of confidentiality protection and ensured that all such confidential reports are appropriately protected from inappropriate access."
DHHS has determined that it did not violate the Health Insurance Portability and Accountability Act, or HIPAA, with the disclosure, Farwell said. The law — which limits the disclosure of sensitive patient information without patients' consent — does not apply to the department's licensing division, which is a health care oversight organization, she said.
The entities the federal law covers are health care providers, insurers and health care clearinghouses.