NORRISTOWN, PA – The Montgomery County Office of Public Health
(OPH) today disclosed that as part of a Right to Know request, unredacted Personal Health Information (PHI) related to COVID cases and exposure in Montgomery County schools was released. This included personal information for students and school staff between the timeframe of September and November 2020. Social Security Numbers were not included.
The personal information was produced in response to a Right-To-Know-Law (“RTKL”) Request filed with the Montgomery County Office of Open Records on March 1, 2021 and includes the student’s name, an ID number assigned for the Office of Public Health internal purposes, date of birth, age, sex, COVID test lab reports with dates, school name, grade currently attended, and additional comments relating to the student’s most recent day at school, symptoms and/or exposure to COVID. Such personal information is exempt from production under the RTKL and the health-related information is protected from disclosure under the Health Information Portability and Accountability Act (“HIPAA”).
Unfortunately, instead of providing a redacted PDF document, the County inadvertently attached to the File the original Excel Spreadsheet with multiple tabs that contain the PHI and personal information.
This information was inadvertently disclosed on or around March 15, 2021. The County became aware of this on May 21, 2021. Immediately following, the County investigated and took immediate steps to remedy the situation and to prevent future access, use, and disclosure of the information. Montgomery County identified the recipients of the File and requested that the recipients delete all personal information and that no further dissemination of the information occur.
As part of the mitigation efforts, the County has reviewed its policies around this issue and are in the process of making necessary revisions to them. The County is also in the process of reviewing its training materials to ensure that any needed additions or clarifications are implemented to avoid such incidents in the future.
The County is providing media notice of this release, has notified all residents affected via mail, as well as the Secretary of the United States Department of Health and Human Services as required by law.