D.C. Family Services Contractor Suffers Personal Data Breach
Inner City Family Services, an agency that contracts for the Washington, D.C. Department of Behavioral Health, made headlines recently when a worker exposed the private information of a dozen patients. Per a report from FOX 5 DC, the station that broke news of the security breach, the employee responsible for the leak had a criminal record.
The employee, LaTonya Vaughter, reportedly underwent a background check. However, the check was a local criminal history screening and didn’t look beyond the boundaries of the District of Columbia. Vaughter had two felony convictions on her record for grand larceny. Vaughter committed those crimes in Virginia.
In January, FOX 5 reported that Vaughter sent “a dozen confidential patient case files” to a college student who had responded to a job ad on Facebook. The job ad itself said nothing about Inner City Family Services or the Department of Behavioral Health. Per the college student who answered the ad, Vaughter (under an alias) wanted to “hire someone to do my [professional] notes for me.”
When the college student answered the ad, she got an inbox full of patient case files. The files included a wealth of sensitive information like names, social security numbers, and medical diagnoses.
The student reached out to Inner City Family Services to report the information leak. Vaughter was subsequently fired from her job with the agency. One of the patients whose information was potentially compromised by Vaughter’s behavior claims that he has been a victim of identity theft. It’s unclear whether Vaughter sent case files to other recipients and if the patient’s identity theft claims can be traced back to her leaks.
The patient data breach has caused the Department of Behavioral Health to reconsider some of its policies, reports explain. Dr. Tanya Royster, the director of the department, said that Vaughter would never have been hired if she had been screened with a more in-depth background check. Royster said that, under current policy, all private businesses that contract for the Department of Behavioral Health and other D.C. departments are required to run background checks on their employees. She said that city policy currently instructs contractors to run employee background checks but doesn’t specify which types of checks contractors should be conducting or how detailed those checks should be.
Per coverage, Royster hopes to tweak the policy so that contractors have more specific guidelines to comply with when they screen their employees. Specifically, she explained, the policy will likely require contractors to perform national or multi-jurisdictional checks. Background checks that look at local criminal records will not be sufficient to meet city requirements, she said.