County officials on Wednesday traded barbs about the handling of notification of a federal HIPPA data breach at the county ambulance service.
County Mayor Weston Wamp said there had been an "inexplicable" gap of 18 days from the time the county attorney's office was notified until he found out. He said Commissioner David Sharpe had been among those who knew early.
County Mayor Wamp said the risk management office, which has been in the county attorney's office since 2022, "is not doing a sufficient job." He initially proposed that it be moved back to human services, but at the meeting he asked that it be placed directly under Chief Operations Officer David Roddy.
County Commissioner Sharpe objected, saying that would be "placing our employees directly in the line of fire of those who have been hostile to them over the past couple of years."
Commissioner Sharpe said there had been four other county HIPPA breaches in the past year. He said those had not been discussed publicly "because of the liability that it presents."
Commissioner Sharpe said administration officials had "threatened and intimidated" some county employees, which he said was a HIPPA violation.
He said, "And now there's been a move to place this individual under the supervision of those who have threatened and intimidated her." Judith Barron-Songy is the current interim risk manager.
He said the move would cause liability issues for the county and was a knowing violation of HIPPA rules on intimidation.
Christy Cooper, county administrator of general services, took the podium, saying, "I tried to keep silent, but I couldn't do it."
She said she had been present at a meeting referenced several times where she said four commissioners attended.
Ms. Cooper said the charges of hostility by administration were "not only unfair, but patently false." She said the only one facing hostility was Claire McVay, the mayor's chief of staff. Ms. Cooper said, "She has done nothing but do her job. She did not deserve the treatment she received."
County Attorney Rheubin Taylor said it had been decided to move risk management to the county attorney office because "it was more akin with the work we do." He said it had "worked well" there.
County Attorney Taylor said when his office learned of the seriousness of the breach it had been working diligently on the matter. He said the notices to those affected was to go out "today."
He said, "The intimation that we have just been dillydallying is grossly in error."
There was a motion to defer action on the transfer of the risk manager with a 5-5 vote. Chairman Jeff Eversole then voted no. That set up a vote to approve the move to work under Mr. Roddy, which passed with only Commissioner Sharpe against.
Commissioner Chip Baker brought up a motion to hire the Baker, Donelson law firm to conduct an assessment of county handling of data security. The cost is to be under $40,000.
Attorney Joe Conner said the project should be completed within 30 days.
County Mayor Wamp said in a Tuesday memo:
I am writing to provide clarity on the recent data breach involving NRS and to address confusion and concerns that have emerged in recent days. I was first made aware of the situation through a Memo from Dana Beltramo received March 11th, more than two weeks after the County Attorney’s office and several County Commissioners were made aware of the incident. We have since learned the Memo of March 11th included several inaccuracies. This memo is intended to set the record straight, outline the facts as I understand them, and ensure we move forward with transparency and urgency.
1. July 2024 Email from NRS On July 14, 2024, NRS sent an email to EMS Billing–a department distinct from EMS. Despite what was stated in Ms. Beltramo’s Memo, this correspondence was not a breach notification. Rather, it was a notice of suspicious activity that NRS was continuing to investigate. The email stated that if it was determined that Hamilton County data had been impacted, we would be further notified.
2. February 2025 Letter from NRS On February 17, 2025, a letter was mailed to “Hamilton County EMS” at the McDaniel Building (Finance Department). This letter is a follow up from the July 2024 email and serves as the formal notification of a confirmed breach. NRS states in this letter that it only recently determined Hamilton County patient/customer information was affected. Accordingly, this correspondence is the triggering document that initiates any obligation the County may have to notify impacted individuals, not the July 2024 email as stated in the Memo the Times Free Press obtained.
3. Timing and Internal Awareness On March 11, 2025, I received an interoffice memorandum from Dana Beltramo regarding a HIPAA breach involving Hamilton County data. This was the first time any member of the County Mayor’s Office received official communication regarding the NRS breach and that it impacted Hamilton County EMS patients. It is deeply concerning that knowledge of this issue existed prior to the March 5 Baker Donelson meeting regarding HIPAA compliance, but was not disclosed to me or anyone with oversight of the day-to-day operations of county government.
- In an email, Rheubin Taylor stated, “my office was informed of the breach incident a couple of days before last Wednesday’s (March 5) meeting,” yet I, as chief executive of the county, was not informed until more than two weeks later. According to Dana Beltramo’s Memorandum, she states the County Attorney’s Office received the February 17, 2025 letter on February 24, 2025, nine days prior to the meeting at Baker Donelson.
- Additionally, when a question arose as to why elected officials were not informed of the breach prior to the Baker Donelson meeting, Commissioner Sharpe noted in an email that “all the appropriate individuals on the County Commission were timely informed and consulted as to when the rest of the CC would be brought up to speed,” further underscoring the withholding of information.
- Prior to this incident, COS McVay and COO Roddy had repeatedly requested through County Attorney Taylor that information pertaining to HIPAA compliance be shared with each of them, so they are aware of issues impacting county general government. This raises serious and troubling questions about the withholding of information from officials. Why was I, along with senior members of my administration, kept out of the loop about such a critical matter for more than two weeks, especially in light of the fact that corrective action will most likely be required?
5. Next Steps As of today, we are just 16 days away from the 60-day deadline to notify patients impacted by this breach. In my conversations with Commissioners, I have learned of an effort to move Risk Management and/or HIPAA compliance as a stand alone department reporting to the Commission. I reached out to CTAS to find out whether a department of county government can report to the Commission and was told: “it is not within the law for the county commission to manage the day-to-day operations of a county department.”
As the Chief Executive Officer of Hamilton County government, I am responsible for ensuring our government remains in compliance with all applicable laws and regulations. However, that responsibility depends on timely communication with my office. When critical information is withheld or delayed, it undermines our ability to act swiftly and puts the county at legal and reputational risk. To meet the 60-day notification requirement and prevent similar breakdowns in the future, I believe Risk Management should be formally placed under the purview of the Human Resources Department, as proposed in Resolution 425-5.