PORTLAND, Maine (AP) A Maine city is apologizing after it shared the information of more than 200 patients enrolled in its now-closed HIV-positive health program without their consent.

The Press Herald reports Portland shared the information with University of Southern Maine researchers for a study on the city’s behalf. The study’s purpose was finding if there were any gaps in service after the program closed and grants that funded it transferred.

Dr. Ann Lemire, former medical director at the clinic that housed the program, says she warned the city that sharing the information would be a violation of the Health Insurance Portability and Accountability Act.

Portland claims its actions did not constitute a HIPAA violation because there are exemptions in place for research and program evaluation.