The Office of the State Attorney has released the names of the Shands employees arrested in connection to compromising more than 14,000 confidential UF&Shands patient profiles.
Arthur Thomas, 25, was arrested Tuesday after an investigation involving the State Attorney's Office, the Internal Revenue Service and the U.S. Secret Service that began last October.
Thomas was an employee at UF&Shands Family Medicine at Main medical clinic.
On Oct. 12, investigators identified Thomas as the alleged source of the patient-information compromise. Law enforcement believed he was selling the identities of UF&Shands hospital patients and learned that he was in Jacksonville.
That month, the Jacksonville Sheriff's Office pulled Thomas over for speeding. Thomas gave law enforcement consent to search his vehicle. According to the report, officers found a black duffel bag inside with a sheet containing about 1,600 patient identities, including names, dates of birth and social security information.
In January, Daremia Crews, 24, was arrested in connection to the investigation for allegedly sending 261 patient profiles to a known source within the identity theft ring.
Crews had previously worked as an intern at the Shands Brentwood Primary Care Center in Jacksonville.
According to the Jacksonville Sheriff's Office arrest report, Crews provided investigators with her cell phone. Analysis of the phone retrieved thousands of messages and photos sent between Crews and another suspect in the identity theft ring.
"Can you see them," Crews sent in one message, dated on June 11, along with photos of confidential patient identity information.
"Get closer because some of em (sic) I can't see so just a lil bit closer," the other suspect responded.
According to Jackelyn Barnard, the State Attorney's Office spokeswoman, the case is an active investigation and other arrests are pending. If convicted, she said the crime carries a penalty of up to 30 years in prison.
The university learned of the initial alleged incident on Oct. 25, after investigators uncovered an identity theft ring targeting several hospitals and health clinics in the state of Florida.
Melissa Blouin, spokeswoman for UF&Shands, said law enforcement asked the hospital to cooperate with investigators and wait to tell patients about the breach until law enforcement made headway in the case.
"In terms of the investigation, we were told that it was alright to release the notification (Wednesday) to patients," Blouin said.
The University of Florida is now mailing letters to 14,339 patients of the UF&Shands Family Medicine at Main practice concerning cases of possible identity theft, according to a press release.
The letter instructs patients to take certain measures to protect themselves from identify theft. The letter also includes information about the incident, identity monitoring services and recommended steps to check credit reports.
Fraud resolution services, which will be valid for one year, will be offered for patients who suspect or can confirm a case of identify theft related to the incident.
Anyone who was a patient between March 2009 and October 2012 and did not receive a letter should contact the UF call center.
Lauren Verno contributed reporting.