Health Department announces security breach after scam uncovered

ORLANDO, Fla. — Several Florida Department of Health employees have been accused of stealing information from thousands of patients, including children, and using it to file bogus tax returns.

Indictments obtained by Channel 9 show how the large scheme worked.

Two employees who worked for the Health Department had access to a large data base containing names, Social Security numbers and birthdates. Those employees would then take photos of the information and send it off to a family member who was operating the scheme, authorities said.

One of the suspects' brothers then filed phony tax returns.

According to the documents, the employees targeted Department of Health patients who were between 17 and 18 years old, most likely because those patients were likely not filing returns of their own at that age, authorities said.

The scheme cited 3,500 victims, 2,200 of whom were central Florida patients of the Department of Health, according to Channel 9's Lori Brown.

The Orange County Sheriff's Office uncovered the scam during a search warrant of the alleged ring leader's Orlando home. There, investigators said they found a handwritten list with 148 names and personal information.

Internal Revenue Service investigators later uncovered the full extent of the elaborate scam and its 3,500 victims.

Channel 9 asked the Health Department what they're doing to make sure something like this does not happen again.

"Extra security with health system, fewer people with access to that info," said spokesman Dain Weister.

The Department of Health released the following statement on Wednesday:

The Florida Department of Health in Orange County (DOH-Orange) is issuing a security breach notice to certain patients of its health centers located in Orange County. Federal investigators revealed today the breach occurred when two former employees created lists containing names, birthdates, and Social Security numbers obtained from patient records. The employees have been permanently removed from access to any and all Department of Health information. Medical information, bank account, credit card or other personal information were not part of the breach.

"We are taking every precaution possible and cooperating with law enforcement to assure all records are maintained with the greatest level of security possible," said Department of Health in Orange County Director Dr. Kevin Sherin. Attempts are underway to notify all affected patients in person or by mail.

Health department patients should review their credit history for any fraudulent or suspicious activities they have not authorized. A free report can be obtained at www.annualcreditreport.com.

If you have had fraudulent activity contact the Orange County Sheriff"s Office at 407-253-7000. The Department of Health can answer general questions at 407-858-1490.

The security of patient information is of critical importance to the Department. The Department is committed to safeguarding confidential patient information and has implemented additional security measures to restrict and control the availability of patient Social Security numbers included in electronic medical records.

WFTV