February 24, 2022

HOUSTON - The Houston Health Department is providing public notification of a breach of health information in its COVID-19 test results portal. The incident is not hacking-related and there is no evidence of malicious intent or misuse of the data.

Approximately 3,500 portal users potentially had access to approximately 10,000 COVID-19 test results, including patient names, addresses, dates of birth, email addresses, testing dates, and test results. The portal does not collect social security or financial information.

The health department was made aware of the potential breach on the night of January 6 and the portal was deactivated within 48 hours. A procedure was implemented to notify patients of results by phone and mail outs.

The investigation to confirm the scope of the incident and to acquire resources for notifications took several weeks. The root cause appears to be a technical issue within the portal that erroneously linked some user accounts.

Letters are being sent to the affected individuals notifying them of the incident and providing information about free identity protection services for one year.

People who receive the letters or used the portal and have questions may contact 1-833-599-2432 from 8 a.m. through 8 p.m. Mondays through Fridays except holidays. The hotline is toll free and provides interpretation services.

The department is committed to safeguarding patient privacy and deeply regrets this incident and any inconvenience it may cause. Additional processes have been implemented to ensure this incident does not reoccur.