Print

Email story

Comment

Email editor

Private data on top state officials compromised

Tighter security is ordered after employees of a company running the personnel system pull out information on Gov. Bush and others.

TALLAHASSEE - The security of the state's new privately operated personnel system is being tightened after a complaint that confidential information on Gov. Jeb Bush, other top officials and law enforcement officers had been compromised.

Department of Management Services Secretary Tom Lewis outlined changes to the People First system in a memo Friday.

An investigation found that employees of Convergys Corp. of Cincinnati, "viewed personal information of senior level state employees." It was unable to confirm any misuse of that data, a DMS inspector general's report said.

"While Convergys already has a comprehensive security procedure ... to protect confidential information, we still felt it would be prudent to put additional safeguards in place," said Lee Ann Korst, a DMS deputy secretary.

A complaint from an unnamed former Convergys worker said company employees for no legitimate reason had repeatedly accessed confidential information in files on Bush, Attorney General Charlie Crist, Chief Financial Officer Tom Gallagher and others.

Certain Convergys and state workers must be able to access sensitive data to properly serve state employees, Lewis wrote.

The report showed that home addresses, Social Security numbers, direct deposit information and other confidential material could be accessed, printed and e-mailed, and the system lacked a way to track who had viewed it.

What the investigation found were "not necessarily weaknesses," Korst said. "I would say we took the opportunity to search for continual improvement."

That includes an automated system of tracking who accesses what information and random computer audits to make sure sensitive data have not been retained.

And access to confidential information will be limited to those who must have it to do their jobs, and employees will be asked to verify their identities by entering information such as their pets' names or favorite sports.

Convergys and DMS already require fingerprinting and criminal background checks for workers with access to confidential information. DMS has recommended fingerprinting and screening for all state employees with access to sensitive personnel data, Korst said.

[Last modified December 24, 2005, 01:09:13]