Express Canna Cards Data Breach Report

Incident Overview

Express Canna Cards, LLC, a Florida-based healthcare entity, experienced an unauthorized access incident affecting approximately 5,000 individuals. The breach was discovered and reported to the Florida Department of Health on October 20, 2025. The unauthorized access occurred within the organization's Electronic Medical Record (EMR) system, a critical repository containing sensitive patient health information. This type of breach represents a significant violation of patient privacy and triggers mandatory notification requirements under the Health Insurance Portability and Accountability Act (HIPAA).

Discovery and Response Timeline

The specific date of discovery and the timeline of Express Canna Cards' response have not been publicly detailed in available breach notification records. However, the October 20, 2025 submission date indicates when the entity formally reported the incident to state health authorities, which is required within a reasonable timeframe following discovery. Upon identification of the unauthorized access, the organization would have been obligated to conduct a forensic investigation to determine the scope of the breach, identify affected individuals, and assess what protected health information (PHI) may have been compromised. Standard HIPAA breach notification protocols require entities to notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of the breach.

Technical Details of the Breach

The breach involved unauthorized access to an Electronic Medical Record system, which typically contains comprehensive patient health histories, clinical notes, treatment plans, and diagnostic information. Unauthorized access breaches of EMR systems generally occur through one of several vectors: compromised user credentials, exploitation of software vulnerabilities, insider threats, or inadequate access controls. The fact that this breach was classified as "unauthorized access/disclosure" suggests that an individual or individuals gained entry to the EMR system without proper authorization and may have viewed, copied, or transmitted patient information. Electronic Medical Record systems are particularly attractive targets for threat actors because they contain consolidated, high-value patient data that can be used for identity theft, medical fraud, or sold on underground markets.

Organization and Service Area

Express Canna Cards, LLC operates in Florida and appears to be involved in medical cannabis card services or related healthcare administration. The organization's focus on cannabis-related medical services places it within the regulated healthcare sector, subject to HIPAA privacy and security requirements. The fact that the organization maintains an EMR system indicates it processes and stores patient medical records as part of its operations. With 5,000 affected individuals, the organization likely operates across multiple locations or serves a substantial patient population within Florida's medical cannabis program.

Patient Impact and Affected Data

Approximately 5,000 individuals had their protected health information potentially exposed through this unauthorized access incident. While the specific data elements compromised have not been detailed in public breach notifications, patients of Express Canna Cards should assume that their EMR data may have been accessed. This typically includes: full names, dates of birth, medical record numbers, Social Security numbers, insurance information, medical history, diagnoses, medications, treatment plans, and potentially financial information. The exposure of such comprehensive health information creates significant risks for affected individuals, as this data can be used to commit identity theft, fraudulent medical claims, or sold to third parties for various malicious purposes.

HIPAA Compliance and Industry Context

Unauthorized access breaches of EMR systems represent a persistent challenge in healthcare cybersecurity. HIPAA regulations require covered entities and business associates to implement administrative, physical, and technical safeguards to protect patient information. When breaches occur, entities must conduct a risk assessment to determine whether notification is required—generally, if there is a reasonable likelihood that PHI has been compromised, notification is mandatory. The breach notification rule requires entities to notify affected individuals, the media (if more than 500 residents are affected in a jurisdiction), and the Secretary of Health and Human Services. Unauthorized access incidents involving EMR systems have increased in frequency across the healthcare industry, reflecting both the growing sophistication of threat actors and the critical importance of strong cybersecurity measures in healthcare organizations.