In its third use of the False Claims Act (FCA) against alleged “cybersecurity failures,” the Department of Justice (DOJ) said March 14 that a government contractor providing services to Florida Healthy Kids Corporation (FHKC) agreed to pay $293,771 in a settlement after its website was hacked.^[1] The contractor, Jelly Bean Communications Design LLC, and Jeremy Spinks, its only employee and 50% owner, was required to comply with HIPAA but dropped the ball, and as a result, the protected health information of about 500,000 children was potentially exposed, DOJ alleged. The effect of Jelly Bean’s alleged disregard for cybersecurity in connection with a program funded partly by the federal government provided a bridge to the FCA, an attorney said.

According to the settlement, FHKC, a state-created entity that offers health and dental insurance to Florida kids between ages five and 18, receives federal Medicaid funds and state funds.^[2] In July 2012, the Agency for Health Care Administration (AHCA), which is Florida’s Medicaid agency, contracted with FHKC to provide services for the state Children’s Health Insurance Program. “This included implementing technical safeguards to protect the confidentiality, integrity, and availability of electronic protected health information received, maintained, or transmitted on behalf of AHCA,” the settlement stated. FHKC turned to Jelly Bean for website design and programming. In an Oct. 31, 2013, agreement, Jelly Bean was required to “provide a fully-functional hosting environment that complied with HIPAA” and “adapt, modify, and create the necessary code on the webserver to support the secure communication of data.”