Two public employee unions are suing the state Department of Public Safety, alleging it unlawfully disclosed the COVID-19 vaccination statuses of 260 of its employees in an Aug. 19 internal email.
The civil lawsuit, which seeks unspecified monetary damages, was filed Oct. 25 in Honolulu Circuit Court by Hilo attorney Ted Hong on behalf of the Hawaii Government Employees Association and the United Public Workers.
The complaint accuses DPS Human Resources Officer Shelley D. Harrington of “malfeasance,” alleging she “deliberately and intentionally released the vaccination status” of the department’s employees to unauthorized co-workers in violation of medical privacy laws and Gov. David Ige’s emergency orders.
The filing also requests that a court find DPS negligent in its training of Harrington — a lawyer whose license to practice is on voluntarily inactive status, according to the Hawaii Bar Association — and to order the department to cease and desist in such disclosures.
Attached to the complaint is a copy of the email, with the identities of the recipients — all with hawaii.gov addresses — redacted.
All were “carbon copy” or “cc” recipients instead of “blind carbon copy” or “bcc” recipients — the latter a mode of transmission that doesn’t disclose to individual recipients the addresses or identities of others receiving the communication.
According to the lawsuit, 118 of the email’s recipients are HGEA members, and 87 are UPW members.
The first sentence of the email reads, “You are receiving this email to notify you that you must upload a negative Covid-19 test every Monday” using a web link.
The email warns that those who fail to do so will be subject to actions listed in a memorandum by DPS Director Max Otani dated Aug. 12. Otani’s memo, which is also attached to the suit, said employees who don’t comply with the department’s vaccination and/or testing requirements “may result in discipline, up to and including termination.”
“A refusal to undergo COVID-19 testing without a valid exemption will be deemed insubordination and immediately subject to termination,” the memo states.
An Aug. 28 complaint letter to Otani from an employee whose signature was redacted described Harrington’s disclosure of “sensitive, private medical info … unnecessarily divulged via general email communication” as “unethical.”
The letter writer said an official Health Insurance Portability and Accountability Act (HIPAA) grievance would be filed “in order to assure, protect and maintain the right to privacy … for the many who were unfortunate victims” of the email incident.
In a Sept. 8 response, Otani said the department’s review of the complaint found that Harrington “did not engage in unethical actions and did not violate HIPAA.”
Otani added that Harrington’s position “is not a ‘covered entity’ subject to HIPAA.” Otani also said Harrington’s email didn’t contain medical information or records or “identify individuals as vaccinated or unvaccinated.”
Otani said Harrington “mistakenly” placed the email addresses in the “cc” field instead of the “bcc” field and immediately but unsuccessfully tried to recall the email. He said Harrington later apologized to all receiving the email and “promised to be diligent in ensuring proper sending selection” in the future.
No hearings on the lawsuit have been scheduled.
DPS said in an email it doesn’t comment on pending litigation.
The HGEA and UPW didn’t reply to requests for comment as of press-time Tuesday.
Email John Burnett at jburnett@hawaiitribune-herald.com.