California Child Care Company Discovers 9-Year Employee Data Leak
A data breach has recently been announced by Child Care Resource Center that shows how even well-intentioned employee practices can result in the exposure of sensitive data. Child Care Resource Center is a California-based non-profit organization, and while it does not appear to be a HIPAA-covered entity, similar data breaches have occurred at entities subject to the HIPAA Rules.
Child Care Resource Center recently learned that one of its employees had been forwarding internal files containing personal data to an external email account. While sending emails containing internal data outside the organization could indicate data theft, in this case, Child Care Resource Center was satisfied that the files were being emailed in an effort to fulfil tasks associated with the employee’s role.
The employee had been emailing data to the external email account for many years before their actions were discovered. The investigation determined that the first instance occurred on October 4, 2016, and continued until October 15, 2025. It took until June 3, 2026, to complete the investigation and review the data involved. The affected individuals are now being notified and have been offered complimentary credit monitoring and identity theft protection services.
The breach notification letter sent to the California Attorney General does not state the exact types of data involved, nor the number of affected individuals; however, considering the practice spanned 9 years, it could be an extensive data breach. When files are forwarded to an external email account, the company loses control of the data and is unable to protect the information against unauthorized access.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
In this case, the company found no evidence to suggest unauthorized data access, nor that any information had been misused. Since unauthorized data access cannot be ruled out in these circumstances, breach notifications are required. Child Care Resource Center said it has implemented additional safeguards to prevent similar incidents in the future.
Healthcare organizations can reduce the risk of incidents such as this by providing regular security awareness and HIPAA training, emphasizing the risks associated with emailing or otherwise copying data to complete work duties out of the office. Technical security measures should be configured to either block the emailing of internal data to external email accounts or, if not practical, to ensure that email security solutions are configured to flag anomalous behavior and closely monitor alerts for potential data security incidents.
