A Florida communications firm and its owner agreed to pay $293,771 to resolve False Claims Act (FCA) allegations that they failed to secure personal information on a federally funded Florida children’s health insurance website, HealthyKids.org.

The March 14 settlement^[1] against Jelly Bean Communications Design LLC represents the third action in the U.S. Department of Justice’s (DOJ’s) Civil Cyber-Fraud Initiative, which aims to hold accountable entities or individuals that put U.S. information or systems at risk by knowingly providing deficient cybersecurity products or services, knowingly misrepresenting their cybersecurity practices or protocols, or knowingly violating obligations to monitor and report cybersecurity incidents and breaches.

Two of the three initiative actions have involved health care entities, and so this effort provides another way—separate from actions by the HHS Office for Civil Rights—for the federal government to hold health care entities accountable for major security lapses that reveal individuals’ personal information.

“Government contractors responsible for handling personal information must ensure that such information is appropriately protected,” said Principal Assistant Attorney General Brian Boynton, head of DOJ’s Civil Division.