The Multnomah County Health Department has begun notifying 1,092 Health Center clients that their protected health information may have been accessed. While there is no evidence that their information has been misused, affected clients are urged to sign up for free identity theft protection offered by the County.
The potential breach involves clients’ names, medical record numbers, Medicaid IDs, dates of birth, gender, race, ethnicity, clinic locations, and dates of service. Importantly, Social Security numbers and driver’s license numbers were not accessed. The breach affects clients seen at various health center locations.
The incident stems from a former employee who failed to return a County-issued laptop upon dismissal on March 4, 2024. Although access to County networks and email was disabled immediately upon termination, an anti-malware system detected suspicious activity on the laptop on April 24, 2024. It was discovered that two spreadsheets containing protected health information had remained on the device.
The County’s IT Security team has taken steps to mitigate the breach. They issued a remote command to securely erase the laptop’s contents if it reconnects to the internet. Additionally, they began identifying affected clients and arranging support services.
A police report has been filed with the Portland Police Bureau (case number 24-107-327) as the former employee ignored demands to return the laptop.
To prevent similar incidents, the Health Department and IT leaders are enhancing technical protocols and training for handling County-issued computers. Supervisory staff are being reminded to retrieve County equipment from departing employees, and new technical measures are being implemented to prevent unauthorized access.
Affected clients are encouraged to enroll in the free IDX Once identity theft protection plan. Clients can also access free fraud alert services from the three major credit bureaus, which offer additional credit protection and free copies of credit reports.
Clients can enroll in identity protection services by visiting the provided link, calling 1-800-939-4170, or scanning the QR code in their notification letter. IDX representatives are available Monday through Friday from 6 a.m. to 6 p.m. Pacific Time.
For more information and updates, please visit the Multnomah County Health Department website or contact their support services.
