County Employee Data Exposed in Public Records Response

I had originally planned on today talking about the Joanna Coutu "firing" process. I had received my records request information that details the firing from Eric Landon's point of view... Landon is Coutu's boss and the one that fired her.

Let's just say that the reason he fired her is BS (forgive the expression) and that she was not wrong. I will have more on this tomorrow.

Something bigger fell into my lap late yesterday that concerns ALL of Citrus County staff. So we are talking that today.

It is routine for me to be cooperating with others who are doing public records requests. I figure whatever I ask for is public record, same with others. So why not share that information when it comes in, especially if working on a project together.

I will not go into too much detail on the project, but I received an email from someone yesterday for a records request that had just gotten fulfilled. This email was sent to myself and 2 other people who are also working on the project. The person who sent it had not gone through the files yet, just forwarded them to the group in an email.

A hour or so later someone responds that there are employee social security numbers on one of the documents. I jump on my phone and look at the files.

Sure enough... there is a file with 74 pages of information. Most of it is a list of names, their social security numbers, their addresses and so on. It appears it includes every employee who has opted into the county's healthcare plan.

This also includes the spouses and children of those employees if they are also enrolled.

Again... this is the social security numbers of staff, their spouses and children. I did not want to download the data to count the number of people, but I did a rough estimate of 1800 or so. Could be more, could be less... but 74 pages of this information.

It is A LOT of people.

Once I learned what was included in this, I reached out to the county attorney via email to tell her that records management has included this information in a public records request.

Coincidentally, right after that, I receive a call from a county commissioner on an unrelated topic. I tell her the problem that I found and she was pretty livid. Her information is disclosed in this as well. She told me she would call Steve Howard as soon as she hung up.

Here is where I have a problem... and a pretty big on.

Where is Steve Howard in all of this? As of this 7am or so this morning, it has been around 12 hours since I told the commissioner. I have yet to receive a cease and desist notice from the county. Nor has the person who had this sent to them originally.

12 hours later and no "we accidentally sent you information that is exempt, please dispose of it and do not share with others" or something to that effect? Nothing?

I assume staff has not been notified as I keep getting messages from people asking if themselves, their relative, spouse, etc is included in this information.

I wont go into too many specifics... but if you are a current county employee and are currently enrolled in the county's healthcare plan, you are on this list... as are any spouses/children if they are enrolled.

This is HUGE.

Next question... How does this happen? Here is the original sharing of information.

Why are these employees sharing Excel spreadsheets with this information in it without any form of encryption, security, etc? And why is it being shared to email addresses and not a secure folder on the server. I know they have them because I have gotten other requests fulfilled that had links... and those links asked for a password to enter the folder, which I obviously did not have.

So how can this information be shared so freely?

The crazy thing with this... Ellen Nichols is the Risk Manager. One would think she would know not to share information like this without some type of security.

Leslie Durham works in HR. Certainly she knows what would be considered personal and private information like this. Why is she emailing it to Ellen without encryption, a password or anything?

Absolutely insane.

And again... 12 hours and no email to myself or the other person asking us not to share it? Nothing to staff as far as I can tell?

What kind of leadership is this?

Also, where is the public records manager, Mike Bridges, in all of this? Why did he let this release slip through.

I have been told countless times that his office has to read every single email or document that is included in a request I have made to make sure nothing exempt is included. Yet, this includes clearly exempt information that can be seen instantly.

How did this get through his office if the rule is to go through everything that is sent prior to fulfilling the records requests?

And why was this even included? The request was for discipline records for Joanna Coutu. How does a list of employee healthcare enrollment get mixed in with that. It has nothing to do with Joanna's discipline record.

Now... question of the day... What is Steve Howard going to do for these employees to make sure they feel that their credit is safe? I had suggested to the commissioner that the county provide credit monitoring for everyone included in the document. Not sure how long is fair... 1 year? 2? 5?

Should something else also be done? If so, what? How can employees trust the county to protect their personal information if this just gets out like this?

Now, I presume the data is safe. I am not sharing the information. The others in the email thread said they will not share the information. However, this was sent digitally. Who knows if it can be breached somewhere now that it has been sent out.

Still a major lapse that cannot happen..

Do we not always tell our kids that once it is floating around on the internet, it is there forever? Is this just going to be a "Oops.. we messed up.. We apologize" type of thing?

Hopefully county employees get answers. We shall see.

Tomorrow we dive in Joanna Coutu's discipline.