HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Dec. 23, 2013.
- Organization as reported
- Florida Department of Health, FL
- Entity type as reported
- Healthcare Provider
- Category as reported
Unauthorized Access/Disclosure
- Location of information as reported
- Desktop Computer
- Submission date
- Dec. 23, 2013
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 15224, row:6363)
- Archived copy
- Held in the private archive (provenance)
On October 30, 2013, the Florida Department of Health, the Covered Entity (CE), was notified by law enforcement officials that Orange County Department of Health (OCDOH) employees retrieved protected health information (PHI) from the CE’s Health Maintenance System (HMS) by taking pictures of their computer screens with their smart phones and providing that information to a third party to file fraudulent tax returns. The breach affected 2,354 individuals and the types of PHI involved included patients’ names, dates of birth, and social security numbers. In response to this breach, the CE sanctioned the two employees, updated its policy regarding access controls for social security numbers, and implemented a statewide masking of social security in its HMS that involves a multi-tiered system for accessing data containing social security numbers. The CE provided breach notification to HHS, affected individuals, and the media, and posted breach notification on its website. The CE provided training on the new policies and procedures throughout OCDOH. OCR obtained assurances that the CE implemented the corrective actions listed above.