Florida medical assistant La Toya Yvette Tillman has been convicted of aggravated identity theft and sentenced to three years in prison.  Through her work at Gastroenterology Consultants she was able to access the database for the entire Memorial Healthcare System, one of the largest health care systems in the country.  Tillman stole personal information including patients’ names, dates of birth and Social Security numbers which she sold by the thousands to identity thieves who, in turn, used the information to file fraudulent income tax returns and commit income tax identity theft.  The lack of security in the health care industry nationwide is far worse than that of retailers such as Target, Home Depot and others that have been the victims of major data breaches.  This case in particular points to the problem of insider identity theft where rogue employees, having access to personal information of patients are able to steal that information.   Regardless of how strong a company’s security is to withstand an attack from outside of the company, it is necessary to combine that security with strong security from threats within the company.


This should be a wake up call to many companies and not just those in the health care industry to better protect the privacy of their data banks from threats within the companies as well as outside of the companies.  Too much information is readily accessible in many companies to too many people in the companies with no need to have access to that information.  However, this case also is a good example of companies having access to Social Security numbers, the key to identity theft when they don’t need this information.  People think that medical care providers need your Social Security numbers, when in fact the main reason medical care providers and others demand the number is to make collection of overdue bills easier for them.  Try to limit as much as possible the companies to which you provide your Social Security number to those that truly have a need for it.  The information stolen by La Toya Yvette Tillman would not have been sufficient for her accomplices to file fraudulent tax returns if the Social Security numbers were not included in the stolen data.