ACLU of Florida Calls for Federal Officials to Investigate Leak of 3,300 Floridians' Prescription Data

The American Civil Liberties Union (ACLU) of Florida has requested that the U.S. Department of Health and Human Services (DHHS) investigate how approximately 3,300 Floridians' confidential prescription drug information, stored in a state-wide prescription drug database, ended up in the hands of third parties without the knowledge or consent of the individuals whose prescription drug information was released.

The complaint filed with the DHHS Office for Civil Rights by the ACLU of Florida "request[s] that the Department investigate this matter and pursue all possible remedies and sanctions against any individuals or entities that have violated protected privacy rights." The ACLU filed the complaint on behalf of the Floridians whose personal information had been compromised by the breach, identified in the complaint as 'Jane and John Does 1-3300.'

"Thousands of Floridians have had personal information - including their names, their addresses, the medications they take, their dosages, the names of their physicians, and the names of the pharmacies that dispensed the medication - distributed to people who never should have had them," stated Maria Kayanan, Associate Legal Director of the ACLU of Florida. "We're calling on the Department of Health and Human Services to help uncover how this breach of privacy from what was supposed to be a secure database could have happened and whether laws were broken in the process."

The confidential prescription records came from the Electronic Florida On-Line Registry of Controlled Substances Evaluation (E-FORSCE) database and were distributed to prosecutors and defense attorneys in criminal cases, despite the presumption that all but six of the thousands of Floridians whose data was distributed were not the subject of any criminal investigation. The request to DHHS follows a series of public records requests sent by the ACLU of Florida to the Florida Department of Health (DOH) and the Seminole County Sheriff's Office regarding the breach seeking records relating to requests made by local or federal law enforcement agencies, or inter-agency task forces, to the E-FORSCE database.

The DOH declined to provide many of the requested records from the ACLU of Florida's initial request, stating that the relevant documents were exempt from records disclosure laws, but did announce new policies to limit access to the database. In response, the ACLU of Florida also submitted an updated public records request to the Department of Health for additional documents related to the breach.

"The decision to put in place new protections on the E-FORSCE database amounts to closing the barn doors after 3,300 horses have bolted," added Kayanan. "It is an acknowledgement that the private data of Floridians in the state's database was not as secure as it should have been. But we already knew that; what we don't know is how or why it happened. That's the question that the Florida Department of Health has to answer for the thousands of Floridians whose privacy they are charged with protecting. This is yet another experience showing that when government is collecting personal information about the activities of law-abiding individuals, that information is rarely as 'secure' as it is claimed to be."

More information about the ACLU's investigation into the leaked data is available here

The complaint submitted to DHHS with supporting exhibits is available here

The records request submitted by the ACLU of Florida today is available here