HomeMy WebLinkAbout10.13.26 Board Correspondence - FW_ FORMAL REQUEST FOR BOARD OVERSIGHT — Butte County Behavioral Health Email Privacy Incident and Unanswered December 10, 2025 ComplaintFrom:Clerk of the Board
To:Clerk of the Board; Connelly, Bill; Cook, Holly; Cook, Robin; Dubose, Teri; Durfee, Peter; Jessee, Meegan;
Kimmelshue, Tod; Kitts, Melissa; Krater, Sharleen; Lee, Lewis; Ritter, Tami; Simmons, Katie; Stephens, Brad J.;
Sweeney, Kathleen; Teeter, Doug; Zepeda, Elizabeth
Cc:Nuzum, Danielle; Hobson, Tony
Subject:Board Correspondence - FW: FORMAL REQUEST FOR BOARD OVERSIGHT — Butte County Behavioral Health
Email Privacy Incident and Unanswered December 10, 2025 Complaint
Date:Wednesday, October 14, 2026 8:25:36 AM
Please see Board Correspondence -
Lewis Lee
Administrative Technician - Confidential
Butte County Administration
25 County Center Drive, Suite 200 • Oroville, CA 95965
T: 530.552.3326
www.buttecounty.ca.gov | lelee@buttecounty.ca.gov
-----Original Message-----
From: Bruce Langberg <rjqy7@hotmail.com>
Sent: Tuesday, October 13, 2026 5:37 PM
To: Clerk of the Board <clerkoftheboard@buttecounty.ca.gov>
Cc: DBH - Privacy <dbhPrivacy@buttecounty.ca.gov>; Kennelly, Scott <SKennelly@buttecounty.ca.gov>; Stark,
Alice <astark@buttecounty.ca.gov>
Subject: FORMAL REQUEST FOR BOARD OVERSIGHT — Butte County Behavioral Health Email Privacy
Incident and Unanswered December 10, 2025 Complaint
.ATTENTION: This message originated from outside Butte County. Please exercise judgment before opening
attachments, clicking on links, or replying..
To: clerkoftheboard@buttecounty.net
Cc: DBHPrivacy@buttecounty.net; skennelly@buttecounty.net; astark@buttecounty.net
Attention: Butte County Board of Supervisors, Chair Bill Connelly, All Board Members, Clerk of the Board, and
County Administration
Dear Chair Connelly and Members of the Butte County Board of Supervisors:
I am requesting formal oversight by the Butte County Board of Supervisors concerning a privacy incident involving
the Butte County Department of Behavioral Health and the department's apparent failure to provide a substantive
response to a written complaint I submitted approximately ten months ago.
This request concerns both the original disclosure of personal information and the County's administrative
accountability in handling complaints involving potential privacy and confidentiality violations.
I. August 15, 2025 Disclosure
On August 15, 2025, at approximately 3:17 p.m., Butte County Behavioral Health distributed an email from
mhsa@buttecounty.net announcing an August 20, 2025 Behavioral Health Advisory Board meeting.
The email placed approximately 250 recipient entries in the visible "To" field, allowing recipients to view the email
addresses of other recipients.
My personal email address was included in that distribution.
The recipients included private individuals, government employees, healthcare-related organizations, educational
institutions, nonprofit organizations, and other entities.
The message identified the distribution as relating to the County's Mental Health Services Act program.
I did not authorize the County to disclose my personal email address to the other recipients.
I recognize that receiving an announcement about a public meeting does not necessarily establish that an individual
receives behavioral-health services or that the disclosed information constitutes protected health information.
However, the County has not provided an explanation of how the mailing list was compiled, whether any addresses
originated from confidential records, or whether the incident was investigated.
II. Unanswered December 10, 2025 Complaint
On December 10, 2025, at approximately 7:31 p.m. Pacific time, I submitted a formal privacy complaint to
mhsa@buttecounty.net.
The complaint identified the August 15 incident and requested an investigation, acknowledgment, and corrective
measures.
As of October 13, 2026, I have not received a substantive written response identifying any investigative findings or
explaining the County's determination.
On October 13, 2026, I submitted additional correspondence to the department's Privacy and Compliance Division
and leadership requesting written findings and an explanation of the County's handling of the matter.
I have also submitted complaints requesting independent review by the U.S. Department of Health and Human
Services Office for Civil Rights and the California Department of Health Care Services.
III. Request for Board Oversight
I request that the Board of Supervisors exercise its administrative oversight responsibilities by directing appropriate
County officials to review this matter and report their findings.
Specifically, I request that the Board seek written answers to the following questions:
1. Why did Butte County Behavioral Health distribute an email exposing approximately 250 recipient entries rather
than using a method that concealed individual addresses?
2. What system or database supplied the recipient addresses?
3. Did any of the addresses originate from patient, treatment, referral, case-management, or other confidential
records?
4. Was the incident reported to the County's designated Privacy Officer or Compliance Officer?
5. Was a documented privacy or security incident assessment performed?
6. Did the County determine whether any state or federal confidentiality or breach-notification requirements
applied?
7. Was my December 10, 2025 complaint received, logged, assigned, and investigated?
9. Were any corrective measures, staff training, or technical safeguards implemented?
10. Has the County reviewed whether similar disclosures occurred in other Behavioral Health mass email
distributions?
11. Has the County evaluated whether its existing complaint-handling procedures provide adequate accountability
and timely written responses?
12. What measures will the County implement to prevent similar incidents and ensure that future privacy complaints
are appropriately addressed?
IV. Request for Administrative Accountability
My concern extends beyond a single mailing-list error.
A County department responsible for behavioral-health services should maintain appropriate safeguards for personal
information and a documented process for evaluating complaints concerning potential unauthorized disclosures.
I request that the Board determine whether the department followed applicable County policies, whether responsible
officials were notified, and whether the handling of my complaint was consistent with appropriate administrative
procedures.
I am not asking the Board to presume that HIPAA or another privacy law was violated. I am asking it to ensure that
the County establishes the relevant facts, identifies applicable requirements, and provides a documented response.
V. Preservation and Review of Records
I request that the Board ensure appropriate preservation of relevant County records, including the original August
15, 2025 email, mailing-list source records, my December 10, 2025 complaint, internal correspondence, incident
assessments, and corrective-action records.
These communications originated from or were previously transmitted to County email systems.
I am not attaching duplicate documents.
Please ask the appropriate County officials to locate and review the records already in the County's possession.
VI. Requested Board Action
I respectfully request:
1. Written acknowledgment that this correspondence has been received and forwarded to the Board of Supervisors.
2. Confirmation that the matter has been referred to the County Administrator, appropriate compliance personnel, or
another responsible official for review.
3. Identification of the individual or office responsible for responding.
4. A written explanation of whether an investigation has been completed or remains pending.
5. A substantive written response addressing the County's findings and corrective measures, to the extent the
information may lawfully be disclosed.
6. Confirmation of whether the Board intends to request an administrative report or other follow-up concerning the
department's privacy and complaint-handling procedures.
7. If the Board determines that the matter should be addressed by another County office, identification of that office
and confirmation that the correspondence has been forwarded appropriately.
I request acknowledgment within five business days and a substantive response or anticipated completion date
within fifteen business days. These are requested response periods rather than statutory deadlines.
VII. Public Records and Confidentiality
I understand that correspondence submitted to the entire Board may become part of the public record.
For that reason, I have not reproduced the approximately 250 recipient addresses, disclosed any individual's medical
information, or included attachments.
I request that the County avoid unnecessary republication of personal information while reviewing the incident.
I also request that any substantive response be provided directly to me in writing by email.
VIII. Closing
The original incident occurred more than one year ago, and my initial written complaint has remained without a
substantive response for approximately ten months.
I believe these circumstances warrant attention from the County's elected governing body.
I respectfully request that the Board ensure that the incident is appropriately reviewed, that responsible officials
provide written findings, and that the County addresses any identified deficiencies in its privacy safeguards and
complaint-handling procedures.
Please confirm receipt and advise what action the Board or County Administration intends to take.
Sincerely,
Cory "Bruce" Langberg
rjqy7@hotmail.com
October 13, 2026