Ex-hospital worker arrested in SGMC data breach

Published 5:15 pm Friday, January 14, 2022

VALDOSTA — A former hospital employee has been arrested in a November data breach case at South Georgia Medical Center, officials said.

Ronald Dean, the hospital’s president and chief executive officer, said Thursday a worker “left employment” with SGMC Nov. 11.

Email newsletter signup

On Nov. 12, security software put out an alert that there had been an unauthorized download of data by an employee, he said. The information left the building on a USB stick, Dean said.

The data was limited; it only involved such things as names, dates of birth and test results,and not financial data, Social Security numbers or medical records, he said.

The files had not been erased, just downloaded, so the hospital lost no information, Dean said.

The employee at the heart of the investigation had legitimate access to the files, the CEO said.

The files were recovered, he said.

“We don’t have any reason to believe that (the downloaded information) was used in any way,” Dean said.

The Lowndes County Sheriff’s Office is providing technical assistance studying the downloaded files to see what was going on, Sheriff Ashley Paulk said.

A 43-year-old female former SGMC employee is charged with felony computer theft and felony computer invasion of privacy, a sheriff’s office statement said. A motive for the unauthorized download is unknown, Dean said.

The hospital is mailing letters to affected patients and is offering free credit monitoring and identity restoration or monitoring services to them, according to a recent advertisement SGMC placed in The Valdosta Daily Times.

Johnny Ball, vice president of marketing and public affairs for the hospital, said no one has access to all of the hospital’s files. “It’s on a need-to-know basis,” he added.

He said all new hires at SGMC are subjected to background checks and drug screenings.

The hospital has a security camera system which can tell when employees enter and leave the building, Ball said.

Ball and Dean said changes are being made to data security at SGMC, including limiting the use of USB drives and retraining employees.

Terry Richards is senior reporter at The Valdosta Daily Times.