The Hamilton County Commission’s chair broke a tie and triggered a vote Wednesday that moved the county’s risk management department under the control of the mayor’s chief operating officer.
The shift came as the county started notifying thousands of people that their personal data was compromised in a data breach last year and as one commissioner said that four other breaches have gone without public discussion.
“There has been no discussion of them publicly, to date, because of the liability it presents,” Commissioner David Sharpe, D-Red Bank said from the dais Wednesday.
Sharpe has sparred repeatedly with County Mayor Weston Wamp and his staff. He hoped to defer a vote on the shift, but commissioners proceeded Wednesday.
Five commissioners – Chip Baker of Signal Mountain and Steve Highlander of Harrison, both Republicans, and Greg Beck of North Brainerd, Warren Mackey of Lake Vista and Sharpe, all Democrats — voted to defer the change to risk management until May, with the county to spend the intervening time working on compliance issues with Baker Donelson, a legal firm.
Asked for his decision on deferring the shift, Commission Chair Jeff Eversole, R-Ooltewah, at first thought the 11-member commission had already opted to wait.
“No matter how I vote, it passed, didn’t it?” Eversole said.
On hearing that his would be the deciding vote, Eversole paused before voting “no” on the deferral.
Reached by phone, Eversole said he’d known how he planned to vote before the meeting.
“I come from a culture where compliance is your life’s blood,” Eversole said. “We can’t wait for 30 days or 40 days or 90 days for there to be another breach or for there to be any type of critical information release, so we have to make sure that we treat people’s private information with dignity and respect. Coming from the corporate world, compliance normally falls under the chief operating officer of an organization. It’s not something that falls under HR.
“Sometimes you got to do things differently. We had a breach,” he said. “We’re currently looking at the causes of the breach, that maybe there’s some things that on our part that we could have done differently.”
SECURITY BREACH
Sharpe later offered the lone no vote on moving the office.
“I believe that this move creates significant liability for the county,” he said. “I feel like I’m kind of between a rock and hard place here. I have a responsibility to the county. I also have a responsibility to the citizens of this county.”
The votes Wednesday followed heated talk among commissioners and county officials about whether the county is in compliance with federal laws regulating health privacy and data exposure.
In July 2024, Nationwide Recovery Services, a county contractor, sent an email to Hamilton County EMS with a subject line “Notice of Security Incident.”
In the email, the contractor’s CEO, Michael Baird, said that the company discovered “suspicious activity” in its network.
“While our investigation is ongoing, we are working to confirm the full nature and scope of the event, including any impact to your organization,” Baird said in the email. “We will provide additional information as our investigation progresses, including if we identify any specific impact to your data.”
The email was also sent to people in the county’s finance and accounting department, according to a confidential legal memo circulated March 11 by the county attorney’s office. The memo said that the county was months late in notifying the public and those affected of the breach. Wamp and his staffers have disputed that argument, saying instead that the county was not officially notified until February of this year, when the contractor reached out to the county again. Its representatives told the county that they determined the data breach may affect customers of Hamilton County’s ambulance services.
Wamp has said that he did not know about the breach until the March 11 memo.
Commissioners were split on waiting, but not on moving the office. The vote to move the risk compliance office passed 10-1.
Commissioner Chip Baker, R-Signal Mountain, then introduced a last-minute resolution, which he said was of “the highest importance,” to allow the county to work with Baker Donelson on a compliance assessment.
That resolution passed, and the county will pay up to $40,000 to the firm. The firm’s work will follow that of a compliance task force, including several county commissioners.
Beck and Mackey both asked about the compliance task force during discussions Wednesday.
“That committee is to study this issue,” Mackey, who sat on the task force, said of the task force. “We’re enlisting outside counsel. Today it’s Baker Donelson, and they’re gonna help us sort that out, but until we get that report, it seems like to me we’re jumping the gun.”
Sharpe, who headed the task force, also said that he was unsure why the county would move risk management when the county was considering paying a law firm to assess the appropriate compliance structure for the county and offer a recommendation in the coming weeks.
(READ MORE: Memo: Hamilton County data breach has gone unreported)
REPEATED CLASHES
The county’s risk management office has been part of the attorney’s office since 2022, shortly before Wamp, a Republican, took office. Former Mayor Jim Coppinger, also a Republican, brought the commission a resolution moving the office from under county human resources, which answers directly to the mayor, and into the county attorney’s office.
The county attorney is Rheubin Taylor, a Democrat who has held the position since the 1990s. Now, risk management will come under the purview of David Roddy, Wamp’s chief operating officer.
Commissioners had been set to vote on whether to move risk management back to the county’s human resources department, which ultimately answers to Wamp, who is charged with overseeing the county’s day-to-day operations.
Wamp asked at the beginning of the meeting to change the resolution to move risk management from the county attorney’s office and place it directly under Roddy.
“Conversations that we’ve had with commissioners have led us, we think, to a better proposal, and that would be that risk management report to the chief operating officer, who in our case has a background around risk management,” Wamp said. “We think that would be an appropriate path forward.”
Like Sharpe, Taylor has clashed repeatedly with Wamp, who tried to fire him shortly after taking office and has criticized him for working against him, in concert with Sharpe. Wamp has begun consulting a special adviser to his office and the commission, attorney Janie Varnell, Wamp’s pick to replace Taylor as county attorney once his work contract expires at the end of June.
(READ MORE: Hamilton County mayor removes Rheubin Taylor from attorney position)
Wamp said in a memo sent to commissioners Tuesday, and during the Wednesday meeting, that Taylor’s office failed to immediately inform him of a major data breach. That failure, he said, left him with concerns about keeping risk management tied to the county attorney’s office.
“We’re losing precious time,” Wamp said. “And, of course, we can always reconsider these things moving forward, but I would say given that time is of the essence on this … breach, let’s trust David Roddy to work with the county attorney’s office to get this thing done.”
When a data breach affects more than 500 people, federal law requires that the responsible party notify the public, everyone affected and the media.
But Taylor disputed Wamp’s argument during Wednesday’s meeting. His office learned of the breach Feb. 24, he said, after the second communication from Nationwide Recovery Services, but his staff didn’t know how many people were affected until March 5. The memo from his office said the first notice, from July of last year, was sent to the county finance department.
“We found out the number on the afternoon of March the 5th,” Taylor said. “And our office has been involved every day since then in doing the steps that are necessary, including having the notification which Commissioner (Gene-o) Shipley asked about ready for distribution. We had one version ready last week. And since last week, we have been trying to get a free agreement from the signers of the notification (including commissioners) as to what the language would be.
“The notification can go out as of today, if we get the appropriate signatures, with everyone’s agreement,” Taylor continued. “So, the indication that the office has been dilly-dallying is grossly in error. We have been working on this in every phase, including trying to get other information, ever since we knew of the magnitude of this, which was March the 5th.”
Contact Mariah Franklin at mfranklin@timesfreepress.com or 423-757-6354.