Translate
The Health Insurance Portability and Accountability Act (HIPAA) of 1996 is a federal law that protects the privacy of individually identifiable health information held by covered entities and their business associates and gives individuals rights regarding that information. The HIPAA Privacy Rule allows for the disclosure of information in instances where it is needed for care, payment for care, and other specific purposes.
HIPAA at Clackamas County
Clackamas County is a hybrid covered entity. This means that HIPAA applies to parts of the county, but not all of it.
County-covered components that perform functions within the scope of HIPAA are required to provide a Notice of Privacy Practices to their clients, which discusses your rights under HIPAA. If you are a client, you can contact your county program for more information.
Notice of Data Breach
What happened
Clackamas County Health, Housing and Human Services Division (H3S) used a survey tool called SurveyMonkey. Some surveys were connected to services covered by a federal privacy law called HIPAA. Because of this, the County should have had a special agreement with SurveyMonkey called a Business Associate Agreement (BAA). That agreement was not in place at the time. We learned about this issue in October 2025 and immediately stopped using SurveyMonkey and took steps to fix the problem.
The County signed the required agreement with SurveyMonkey on December 2, 2025, and changed its internal processes to stop this from happening again.
What information was involved
The surveys asked for feedback, such as ratings and comments. Depending on what someone chose to share, information may have included:
- Name or contact information, and
- The fact that the person received County services.
The surveys did not ask for medical records. No clinical charts were included.
What we are doing
The County works to keep personal and health information safe. We have:
- Signed the required privacy agreement
- Improved rules for using survey tools
- Reminded staff to use only approved tools
For more information
If you have questions or want to know whether your information may have been involved, please email: hipaa-privacy@clackamas.us
Contact us
If you think your privacy rights have been violated, or if you have questions or comments about HIPAA, send an email to hipaa-privacy@clackamas.us or contact the privacy manager for a specific county department.
No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.