The Office of the Maine Attorney General is looking into accusations that the city of Portland violated the privacy rights of HIV-positive clients when it gave their personal health information to researchers looking to evaluate a health care program for people living with HIV, The Portland Press Herald reports.

Although city officials apologized for not alerting the nearly 230 people in the HIV program that it was going to share information about their health, the officials also claim that they did not breach federal Health Insurance Portability and Accountability Act (HIPAA) privacy laws. According to them, HIPAA allows for the exchange of such information for research and evaluation purposes.

The attorney general’s office, however, has received two formal complaints from patients and is reviewing them.

The issue involves a federally funded HIV-related program at the India Street Public Health Center. When the program ended in December 2016, the city transferred it to the private nonprofit Portland Community Health Center (now Greater Portland Health).

However, as the Press Herald reports, only 33 of the 229 participants made the switch to the new program, prompting the city to work with researchers at the University of Southern Maine to figure out why.