McALESTER, Oklahoma - A couple is suing a Green Country hospital following the drowning death of their toddler.

They say employees at McAlester Regional Health Center violated their federal privacy rights by calling their adopted son’s birth mother, leading to threats against their family.

The mother and father say they hadn’t even had time to start grieving the death of their child, Keon, when the birth mother called, screaming.

They say things got so bad that they had to file a protective order.  They believe the problems could have been prevented if hospital employees had followed policy.

“He was all boy,” said the child’s mother, Denise Russell.

“He was all over the place.  He was very fun loving,” stated Wayne Russell, the father.

The Russells had taken care of Keon since he was just two weeks old.  They finalized the adoption in July 2015 and the birth mother terminated all parental rights.

Keon was almost 2 years old when a gate was accidentally left open.  His parents say that within less than five minutes, he went through it.

“He was in our swimming pool,” said Denise.  “He loved the water.”

His parents started CPR and paramedics rushed him to McAlester Regional Health Center.

“All of a sudden, they told us ‘you have to leave,’” recalled Denise.  “We didn’t get to spend any time with our baby.  I didn’t get to hold him.  Nothing.”

Just minutes later, she says, the birth mother called her.

“I asked her, ‘How do you know?’  And she said she had gotten a phone call from the hospital,” said Denise.

The hospital sent a letter to the Russells admitting a leakage of information and apologizing for the inconvenience.

“We got harassed.  She showed up to visitation at the funeral … she threatened to kill our other son,” Denise exclaimed.

“They had to get a judge involved.  There were protective orders,” said attorney Mark Edwards.

Edwards says this is a clear HIPAA violation.

“When you have their medical information, you don’t disclose that,” he said.

“We want to see that this don’t happen to anybody else, ever again,” declared Denise.

Records show that multiple people accessed Keon’s medical records, including a cafeteria worker, but the family says that there was no reason for anyone to access the records because their son didn’t survive.

It’s also unclear if the birth mother had any relationship with any hospital employees.