‘I felt exposed’: Meck County sends internal email identifying unvaccinated employees

MECKLENBURG COUNTY, N.C. — Mecklenburg County’s HR department emailed employees Monday morning who had not submitted proof they were vaccinated and left their names in the “to field,” thus identifying them, according to emails sent to Channel 9′s Joe Bruno.

According to an email by County Manager Dena Diorio and obtained by Bruno, the message was intended for “all employees.”

The email told employees who hadn’t submitted proof they were vaccinated, that mandatory weekly testing would resume this week. The policy was paused due to the surge in testing demand.

“I was in total shock. I felt exposed,” one employee told Channel 9. “I felt like there was no regard to my privacy or my decision, and I felt like that it was a reckless decision to send this email out with our names on it.”

In an email to county commissioners and top county leaders, Diorio claimed the email Monday morning “was not a HIPAA violation” despite identifying employees who haven’t submitted proof of vaccination.

Some county employees said they don’t agree, and one told Anchor Genevieve Curtis that they felt exposed after seeing that email. Some employees said they’re worried about how their co-workers will treat them after being outed as unvaccinated.

“For me, I felt my job was in jeopardy if I didn’t take it. It was a very stressful process. It’s been very stressful having to sit in lines for hours trying to get tested,” one employee said. “And as an employee I felt badgered, I felt bullied and continue to feel bullied by the county.”

Several employees told Channel 9 they plan to file complaints for a HIPAA violation.

The county said an apology email will be sent to all impacted employees.

Curtis took the email to health care and employment law Attorney Karen McKeithen Schaede, who said once an employer has your vaccination information, it becomes confidential.

“It is supposed to be protected under HIPAA and not released unless there is a need to know,” she said. “The problem with the e-mail is that they should have BBC’D everyone, instead of CC’D everyone because of the content of the e-mail.”

Schaede said employees could file complaints with the Department of Health and Human Services Civil Rights Division. She said if NCDHHS determines it’s a HIPAA violation, the county could face a $1,000 fine per violation.

“I think your first step is to alert your employer that you feel like your HIPAA rights have been violated and make sure they’re aware of that first. Then, maybe file a complaint if you don’t get any recourse,” Schaede said.

Meanwhile, employees said the list is already getting shared.

“I’ve had at least two people call me that are vaccinated and asked me about this e-mail,” one employee said. “I don’t know what the future holds for me as a county employee.”

Channel 9 reporter Joe Bruno spoke with County Commissioner Laura Meier about the incident.

Meier said she hopes the county has learned its lesson and has learned to double or triple check sensitive information.

“It was a human mistake. And I’m sorry, it happened. I’m deeply sorry, it happened,” Meier said. “Let’s just hope that never happens again. Seriously, that was bad. Bad mistake.”

Not counting the Sheriff’s Office and Library, the county has 443 employees who are unvaccinated, according to the latest data presented to county commissioners. The Sheriff’s Office and Library have separate HR departments and are not included in the county’s total.

The email sent Monday morning by HR compliance was sent to 443 people.

Full statement from Mecklenburg County:

“We are aware of an email that was sent in error this morning but according to the County Attorney, did not a violate the HIPAA privacy rules. The email was intended to go to all County employees, not just a select group. Unfortunately, it went only to those employees who have not submitted proof of vaccination pursuant to County policy. The intent of the email was to inform all County employees that the County had reinstated the suspension policy for violations of our COVID-19 testing protocol for unvaccinated employees. The policy had been temporarily suspended due to the long lines and delayed results people were experiencing at testing sites right after the holidays. Now that the lines are subsiding, and results are quicker we are reinstating the suspension portion of the policy. The email will be sent out to all employees, and an apology email will be sent to those who received and opened the original email this morning.”

Bruno reports that this is the second time in five years that Mecklenburg County has accidentally sent out personal information.

Back in 2017, the county mistakenly sent Channel 9 the personal medical information of thousands of health department patients.

(WATCH BELOW: At-home COVID-19 test kits, N95 masks to be distributed in Mecklenburg County)

At-home COVID-19 test kits, N95 masks to be distributed in Mecklenburg County

©2022 Cox Media Group