Florida Department of Health

On October 30, 2013, the Florida Department of Health, the Covered Entity (CE), was notified by law enforcement officials that Orange County Department of Health (OCDOH) employees retrieved protected health information (PHI) from the CE’s Health Maintenance System (HMS) by taking pictures of their computer screens with their smart phones and providing that information to a third party to file fraudulent tax returns. The breach affected 2,354 individuals and the types of PHI involved included patients’ names, dates of birth, and social security numbers. In response to this breach, the CE sanctioned the two employees, updated its policy regarding access controls for social security numbers, and implemented a statewide masking of social security in its HMS that involves a multi-tiered system for accessing data containing social security numbers. The CE provided breach notification to HHS, affected individuals, and the media, and posted breach notification on its website. The CE provided training on the new policies and procedures throughout OCDOH. OCR obtained assurances that the CE implemented the corrective actions listed above.