Human error happens. What changed afterward?

Citrus County appears to have done the right thing after discovering that sensitive personal information belonging to about 1,300 county employees and family members had accidentally been released. County officials acted quickly. They contacted the Sheriff's Office, notified their cyber liability insurer, brought in attorneys specializing in data privacy, arranged identity protection services and began communicating with the employees affected.

Those were appropriate steps, and County Administrator Steve Howard was right not to wait for the next County Commission meeting before acting. When Social Security numbers and other personal information have been released, time matters. The county could ultimately be responsible for as much as the $25,000 insurance deductible. That is an unfortunate expense for taxpayers, but protecting the people whose information was exposed must come first.

Now comes the other part of the county's responsibility: Tell us what has changed.

Human error happens. It inevitably does. Someone attaches the wrong document. Someone hits "send" before checking. Someone overlooks something that seems obvious afterward. Government cannot create a workplace where nobody ever makes a mistake, but it can create a system designed to catch mistakes before they become expensive ones.

In this case, the County Records Manager acknowledged that he failed to check the attachment before sending the response to a public records request. The attachment was not an inconsequential document. It was a 74-page spreadsheet containing sensitive information about county employees, spouses and children. The employee subsequently lost his job, but firing an employee should not be the end of the discussion.

The larger question is whether this happened because an established safeguard was not followed or because the safeguard was not strong enough in the first place. If county procedures already required attachments to be reviewed before public records were released, why did that process fail? If they did not require an additional review when documents contain large amounts of employee information, should they now?

Should certain files containing Social Security numbers or similar information be more clearly identified or restricted? Should public records responses involving sensitive databases require a second employee to verify attachments before they are transmitted? We are not suggesting any particular technical solution. County information technology, legal and records professionals are better equipped to determine that.

But taxpayers and county employees deserve to know that somebody has examined the process from beginning to end. There is an important difference between explaining how a mistake happened and explaining what has been done to prevent it from happening again.

The county has been forthcoming about the breach itself and its response. That deserves recognition. Now commissioners should ask the next question publicly: What safeguards have been strengthened?

Mistakes happen in every workplace. Good organizations respond to them. Better organizations learn from them. Citrus County has taken responsibility for dealing with the consequences of this mistake. Now it should assure its employees and the public that it has also addressed the system that allowed the mistake to happen.

Distributed by Newsbank, inc.