Complain about a product or service

Northwest Hospital Chain Loses Patient Data

Stolen Laptop Contains Unsecured Data on 365,000 Patients

By Martin H. Bosworth
ConsumerAffairs.com

February 2, 2006

• RFID Eyed as Anti-Shoplifting Tool • Internet Providers Admit to Monitoring Customers' Web Surfing • Big Brother Hitching A Ride in California? • GAO: Government Can Do More to Protect Personal Data • US Search Agrees to Stop Selling Private Credit Data • TSA Site Left Passenger Data Exposed To ID Theft • Connecticut Governor Wants 'Opt Out' For Online Directories • Verizon Gave Customer Data To Government Without Court Orders • House Democrats Probe Warrantless Surveillance --- • More Privacy News ...

The latest case of stolen consumer data involves a laptop containing the medical and personal records of 365,000 patients of the Providence Health Care system, which operates hospitals in Oregon and Washington.

The laptop was stolen from the van of an information services analyst who worked for Providence on Dec. 31st. The thief broke open the van window to steal the data, which contained names, addresses, Social Security numbers, and medical diagnoses for patients in Providence's Home Care division.

The data also contained information on 1,500 current and former Providence employees. The theft was not publicly disclosed until Jan. 25th.

Taking home backup copies of patient data was an accepted practice for specific employees, according to Rick Cagen, Providence's chief of operations in Oregon. The data was not encrypted or protected against misuse.

Cagen said that Providence has instituted a policy of encrypting all data on its laptops and storing offsite data in more secure locations since the theft occurred.

The theft has sparked an investigation from Oregon's state Attorney General, Hardy Myers. Myers' spokesperson Jan Margosian said the theft represents more than a "breach of trust" with the company.

"[Customers] can expect, when they're paying for a service and they've given a business their personal, financial, medical information that they will keep it safe and secure," Margosian said.

One angry patient, Laurie Paul, has already filed a lawsuit seeking damages against Providence for not protecting her information. Paul's attorney, David Sugarman, is seeking class-action status for the suit.

Oregon has no laws mandating that companies disclose data thefts to customers. The data breach has renewed calls to pass stronger privacy and information security laws by the state legislature.

State Rep. Carolyn Tomei had sponsored an identity theft protection bill in last year's session, but the bill was defeated under pressure from business interests, who claimed that such things as credit freezes would unfairly hamper the ability of consumers to make new purchases.

Technology trade lobbyist Jim Craven said "We're hoping we can work this out at the national level because it does cry out for a national response."

Consumer groups, security experts, and privacy analysts claim that state laws currently on the books in many states are stronger than any of the federal legislation being discussed in Congress right now. Pre-empting state laws with weaker federal laws would give the credit and finance industry too much power, and consumers too little protection, they argue.

"It's hard to get the public even knowledgeable about these issues," Tomei said. "But once it's out in public and it hits the front page of the paper, then the public is much more interested and realize that their own security is at risk."

Providence had just completed a deal with the Citadel Security Software company to improve vulnerabilities in its network systems.

Citadel's "automated risk verification" system is designed to "mitigate the risk of security vulnerabilities by providing IT staff with the means to remediate vulnerabilities quickly and effectively while meeting IT security requirements."

The ability to mitigate vulnerabilities clearly did not include leaving unprotected data on laptops in cars.

Report Your Experience
If you've had a bad experience -- or a good one -- with a consumer product or service, we'd like to hear about it. All complaints are reviewed by class action attorneys and are considered for publication on our site. Knowledge is power! Help spread the word. File your consumer report now.

Follow us on Twitter.

Back to the top |