Psychiatric patients' IDs stolen by hospital worker, feds say

[Erica Absetz <erica () riskbasedsecurity com>]

http://www.sun-sentinel.com/fl-id-theft-psych-hospital-20130611,0,5669451.story

Curtis Fullwood's job was to help patients with mental health problems
find work they could do in the South Florida State Hospital in
Pembroke Pines, but instead, authorities say, he stole their
identities.

Fullwood, 57, and his cousin, Terri Davis, 45, have pleaded not guilty
to a federal indictment charging them with conspiracy to commit
identity theft, conspiring to disclose individual's health
information, access device fraud, wrongful disclosure of health
information and aggravated identity theft.

The two are accused of working together to steal individual patients'
names and social security numbers to file fraudulent income tax
returns between September of last year and April, investigators said.

Fullwood obtained patients' information by illegally using computers
at the Pembroke Pines psychiatric hospital to steal the identities of
people who were admitted for treatment, according to court records.
The two suspects had identifying information for more than 1,000
people without their permission, FBI agents wrote.

Both men are free on bond pending the outcome of the case. Fullwood is
on unpaid leave from his job and a judge ordered him not to work in
any role that would give him access to other people's Social Security
numbers.

"Due to the ongoing nature of this case, we're unable to comment at
this time; however we can confirm that Mr. Fullwood has been placed on
leave without pay pending the outcome of the case, and our company is
cooperating fully with the investigation," David Meehan, a spokesman
for GEO Care LLC, a private company in Boca Raton that runs the state
hospital, wrote in an email Tuesday.

Fullwood's lawyer said he had no comment after a brief court hearing
Monday in federal court in West Palm Beach.

Fullwood has worked for the hospital for more than 12 years and "his
current responsibilities include assisting psychiatric patients at
South Florida State Hospital to obtain jobs within the hospital,"
agents wrote.

Most of the patients at the hospital, at 800 East Cypress Drive in
Pembroke Pines, are involuntarily admitted for mental health treatment
there at the request of Florida's Department of Children and Families,
according to court records.

Davis and Fullwood came under suspicion when Davis turned over some of
the patients' identities to an informant who was working under cover
with the FBI, agents wrote. The meeting was secretly recorded, records
show.

Davis reportedly told the informant the information came from "the
dude in the hospital" and that "he gonna get some more today."

GEO Care workers checked their computer records and found that
Fullwood was the only employee who viewed patient admissions reports
on their computers on the dates in question.

The most serious offenses carry a penalty of up to 10 years in federal
prison and fines of $250,000, records show.
_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
Risk Based Security equips organizations with security intelligence, risk
management services and on-demand security solutions to establish
customized risk-based programs to address information security and
compliance challenges.