On September 21, 2026, Citrus County records manager Mike Bridges answered a public-records request about a personnel matter involving Growth Management Director Joanna Coutu. According to the Citrus County Chronicle, he attached a 74-page spreadsheet of county health-insurance enrollment data — Social Security numbers, dates of birth and home addresses for employees and their covered spouses and children. The county puts the affected population at about 1,300 employees and their family members. The requester forwarded the email to two other people before the county was alerted.
The county learned of the disclosure that evening and contacted its cyber liability insurer; it is carrying a $25,000 deductible, and commissioners were asked on October 27 to ratify the counsel and identity-protection agreements. Bridges’ supervisor — Chief Information Officer Louis Foltzer — recommended termination in a September 22 HR memorandum. Bridges appealed, and subsequently lost his job.
The review step existed and was skippable
The part worth reading twice is in that memorandum. Bridges, it says, "did not send the relevant records to the appropriate county department for its required review before releasing them." His own written acknowledgment supplies the other half: "The document was included during my review of records for release."
The designed path was three steps — the records office assembles the response, the originating department reviews it, the response goes out. One person performed the first, was responsible for initiating the second, and could perform the third. Nothing between the attachment and the sent message registered that the review had not happened. A review the sender initiates, and that the send does not wait for, is an instruction, not a control.
Note where the function sits: the records manager reported to the CIO. The channel that released the SSNs was inside the technology organisation’s reporting line, which is not the same as being inside its control inventory — the same gap as a mandatory field nobody downstream ever reads.
What Florida law required of the file
Redaction here was not a judgment call, and the statute's own structure shows it. Fla. Stat. §119.071(4)(a)1. provides that "[t]he social security numbers of all current and former agency employees which are held by the employing agency are confidential and exempt" from disclosure. The next subparagraph enumerates the only circumstances in which the agency may disclose them: where disclosure is "expressly required by federal or state law or a court order," to another agency that needs the number for its duties, or on the employee’s express written consent. A records requester is none of the three.
A separately worded provision caught a second population. Section 119.071(4)(b)2.a. exempts "[p]ersonal identifying information of a dependent child of a current or former officer or employee of an agency, which dependent child is insured by an agency group insurance plan." It reads "exempt" without the enumerated disclosure list attached to the SSN provision — a weaker shield, but one that still required someone to treat covered children as a distinct category.
Put the enforcement point in the send path
The useful question is not whether a procedure requires a second review. It is which component fails closed when that review did not happen.
With a mail gateway: pattern-match outbound attachments leaving the records mailbox for SSN-shaped strings and quarantine on a hit. That produces false positives on legitimate productions, and someone works the quarantine daily — ten minutes a day, which is why it keeps not getting deployed. Assign it to a named role or don’t claim the control.
The version that needs no licence: give the records office a release mailbox that cannot send externally. The assembled response lands in a queue, and the originating department's approval is what moves it out. That converts the required review from a step the sender invokes into one the message cannot route around. The cost is latency on every response, against a statute requiring production within a reasonable time — so set the queue's SLA well inside what your office promises requesters.
Both are downstream fixes. The upstream question nobody has asked is why a health-insurance enrollment extract containing SSNs was reachable from a records-review workspace at all. If you cannot gate the mail path this quarter, make the file unreachable instead: reduce the standing copies of that extract to one, somewhere the records workspace does not mount — the same problem as knowing which systems hold which identifiers before you have to answer for them.
How to check this where you work
- List every outbound channel carrying files a human assembled: records responses, subpoena productions, auditor packets, broker submissions.
- For each, name the component that would stop a wrong attachment. If the answer is "the person checks," that is the finding.
- Walk the path, do not read the procedure. The document shows a required second review; following a real response shows whether anything enforces it.
- Search the records workspace for data that should not be there:
grep -rlE '[0-9]{3}-[0-9]{2}-[0-9]{4}' /path/to/sharefinds the spreadsheets nobody remembers exporting. - After your last incident of this type, ask whether the remediation changed a system or a person. Only one of those still works next year.
As of October 27, the county says it and the Sheriff's Office contacted the recipients and confirmed the information was deleted and not disseminated further. Neither Chronicle report describes a change to the release process.
North InfoSec runs AI-assisted penetration testing and security assessments, including the egress and data-classification review described above. northinfosec.com