FLORIDAMisuseHealthcareGovernmentHealthcarePrivilege AbuseMisuse OtherCustomer Data InvolvedData ExfiltratedWire FraudHealth (basic)Identity (basic)Government IDHighResolved

Florida Department of Health

bd_51f19f940f5c5865 · schema v1 · pii pii-v1

Severity

High

Discovered

Oct 30, 2013

Filed

Dec 23, 2013

To disclose

8 weeks

Affected

2,354

Confidence

97%

Full breach record for Florida Department of Health →5 incidents on file

Florida Department of Health reported to HHS on 2013-12-23 an Unauthorized Access/Disclosure affecting 2,354 individuals. OCDOH employees with authorized access to the CE's Health Maintenance System (HMS) photographed computer screens containing PHI with smartphones and provided the data to a third party for fraudulent tax return filing. PHI exposed included patient names, dates of birth, and Social Security numbers. Breached information located on Desktop Computer. The CE sanctioned the employees, masked SSNs system-wide, updated access policies, and completed staff training. OCR obtained assurances of corrective action.

J jump to incidentP pin to compareR raw source

HIPAA clock✓ HHS report on time8 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

discovery → filing · 8 weeks / 54 days

Oct 30, 2013

Discovered

Dec 23, 2013

Filed

vs. sector median

5 wks faster

Tracked as a single-filing incident — the only disclosure on record for this event so far.Confirmed2,354 affectedView incident

Name: Florida Department of Health
norm: florida department of health
Domain: floridahealth.gov
Industry: Health Care Services

Name: Florida Department of Health
norm: florida department of health
Domain: floridahealth.gov
Industry: Health Care Services
Industry: Healthcaresource defaultGovernmentllm

Discovered: Oct 30, 2013
Materiality determined: —
Notification sent: —
Affected individuals: 2,354nationwide
Data types: Health (basic)Identity (basic)Government ID
HHS breach type: Unauthorized access or disclosure
Where the data lived: Desktop computer
Covered-entity type: Healthcare provider
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid AccountsT1052 Exfiltration Over Physical Medium
Threat actor: InternalFinancial
Regulator citations: HHS OCR notifiedOCR obtained assurances that corrective actions were implemented
Initial access: insider_action

During the incident: Sanctioned the two employees responsible
Updated policy regarding access controls for social security numbers
Implemented statewide masking of social security numbers in HMS with multi-tiered access system
Provided breach notification to HHS, affected individuals, media, and posted on website
Provided training on new policies and procedures throughout OCDOH
Changes made: Statewide SSN masking in Health Maintenance System (HMS)
Multi-tiered access control system for SSN data
Updated access control policies
Staff training on new policies
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(54 days from discovery to filing)
Compliance flags: HHS report on timeHHS notified
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.
Clock breakdown: Statute Window Elapsed Threshold Status
HIPAA
Discovered: Oct 30, 2013
→ Notified: not extracted
— 60 days HHS report on time
HIPAA
Discovered: Oct 30, 2013
→ Notified: not extracted
— regulatory submission HHS notified

Statute	Window	Elapsed	Threshold	Status
HIPAA	Discovered: Oct 30, 2013 → Notified: not extracted	—	60 days	HHS report on time
HIPAA	Discovered: Oct 30, 2013 → Notified: not extracted	—	regulatory submission	HHS notified

Status: No extraction artifact recorded for this disclosure.

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
DisclosureLens renders the full SEC/HHS filing inline below from the originating regulator’s public record (§4.5 fair report privilege).
Filed at: Dec 23, 2013
Raw hash: b3a741353f1cdf0f4f5667b189591683fe034d6e73dfa2d72be6fa86cb494d9c

AI-assisted summary above. The structured extract on this page was generated from the document below. Inspect the source to verify or correct any field.

text/html2.1 KB

Download View at source

Reporting entityFlorida Department of Health

Victim entityFlorida Department of Health

Incidentdiscovered Oct 30, 2013

Stated responseSanctioned the two employees responsible

ComplianceHHS report on time

Extraction provenanceno artifact recorded

Source provenanceocrportal.hhs.gov

Source filing