Jackson Health System Hit by Five-Year Insider Data Breach Affecting 2,000 Patients Jackson Health System (JHS), Miami-Dade County’s public hospital network, disclosed a data breach involving the unauthorized access of over 2,000 patients’ personal and medical records by an employee. The breach, which spanned nearly five years from July 2020 to May 2025 was carried out by a staff member who exploited the data to promote a personal healthcare business. The exposed information included patient names, birth dates, addresses, medical record numbers, and clinical details, though Social Security numbers were not compromised. JHS terminated the employee upon discovering the breach but did not specify which of its facilities was involved or why the unauthorized access went undetected for so long. This incident marks the second time in less than a decade that JHS has faced a prolonged insider breach. In 2016, the system reported a similar five-year unauthorized access case, leading to a 2019 settlement with the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR). The OCR’s investigation at the time found systemic failures, including delayed breach notifications, inadequate risk analyses, and insufficient access controls. JHS paid a $2.15 million civil penalty but was not required to implement a corrective action plan. The latest breach raises questions about whether JHS has addressed the vulnerabilities identified in the 2019 settlement, particularly regarding monitoring and access restrictions. The OCR has not yet indicated whether it will launch a new investigation.