HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Jan. 20, 2017.
- Organization as reported
- Multnomah County, OR
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Submission date
- Jan. 20, 2017
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14293, row:5432)
- Archived copy
- Held in the private archive (provenance)
Multnomah County, the covered entity (CE), reported that a workforce member automatically forwarded all of his work emails to his personal email account for over four years. Approximately 1,200 individuals’ electronic protected health information (ePHI) was affected by the breach and included clinical and demographic information. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE sanctioned the workforce member responsible for the breach and provided reminders to workforce members on the proper use of email accounts. In response to OCR’s investigation, the CE implemented a process to perform a monthly review of the CE’s email users that have automatic forwarding. As a result of the investigation, the CE is expected to conduct a complete and thorough risk analysis and implement a corresponding risk management plan in conformance with the HIPAA Rules.