Is This A Hipaa Violation? What About Ors 192.553–192.581?

Location: Oregon

The full email below, with everything personally identifying redacted, is one I received late Sunday night from a clinic where I saw a provider there twice. In slightly more professional language, they've reached out saying

"Hey , we know you used to be a patient of . We just fired her, and just to let you know, if you go to her new clinic it's being run by a sex offender. Remember, you have a choice who provides you care - think carefully!"

It's got my hackles up that this is probably a hipaa violation - It's a plain-text email disclosing a patient-provider relationship, done for a business purpose with a thin veneer over the top. Blows way past 'minimum disclosure required' especially since I'm an ex-patient. It's also clear I'm a BCC on a much larger list - this went to all of their current and former patients. The communications policy I signed as a patient was very clear that all PHI communication would go via Spruce secure messaging app - so they violated their own policies as well. But at the end of the day I'm not a lawyer, just a systems engineer who used to do IT for medical practices; I'm fishing for second opinions.

Questions:

1. Is this probably a HIPAA violation? Is it worth filling out an HHS report?
2. Is this a violation of something I can report to the state? If so, is the most appropriate path OHS, or DOJ, or some other licensing agency? Oregon's got their own privacy laws under ORS 192.553–192.581, but I haven't spent nearly as much time looking at them as HIPAA.
3. Is there some other path here - a state licensing board or professional standards agency?

----

Full Message:

Dear ,

On behalf of , I am writing to you because our records indicate that you previously received care through with and that your care may recently have been transitioned to another practice. We want to make sure that you have accurate information about the circumstances that led to recent changes involving certain individuals who are no longer affiliated with .

Earlier this year, terminated its professional relationships with certain individuals who we believe encouraged our team members to leave and to recruit patients with them. Our decision to separate from these individuals was not made lightly. Specifically, we learned information that had not previously been disclosed to us regarding an individual, , who appears to be directly working with the new practice you may have transitioned to, has a prior criminal record and registry listings related to his past sexual offenses involving minors. Once this information was confirmed from publicly available criminal records and by an independent investigator, we immediately terminated him and took steps to prevent his access to our patients and their information because concluded that it could not responsibly continue the relationship with in light of the sensitive nature of a healthcare practice that serves vulnerable patients and families. ended the relationship to protect its patients, the integrity of the practice, and its clinicians.

Unfortunately, it appears that thereafter decided to recruit several professionals to leave and form a new practice with his behind-the-scenes leadership. We are sending this so that you can decide about your own care and affiliation.

We want to be clear about two things. First, remains fully committed to providing high-quality behavioral health care in a safe and professional environment. Second, patients always have the right to choose their healthcare provider, and we respect whatever decisions our patients make regarding their care.

We are sharing this information simply so that you are aware of the circumstances that led to these changes and so that you can make fully informed decisions about your care. If you have any questions about this matter, or if you would like to discuss continuing or resuming care with , our team would be happy to speak with you. Please email us at info@.com or call us at .