Official admits Portland didn’t initially follow proper protocols in disclosing patients’ information