NEW YORK STOLEN COMPUTERS AT VASSAR BROTHERS MEDICAL CENTER INVESTIGATED PoughkeepsieJournal.com - Computer security a question:

Thursday, February 8, 2007
Computer security a question

By Irwin M. Goldberg
Poughkeepsie Journal


Security may have been an issue with other computers at Vassar Brothers Medical Center, according to internal documents obtained by the Journal.

Part of the investigation into the laptop taken from Vassar Brothers Medical Center looked into how the alleged thief got access to the computer.

Center officials told the Journal in an interview and 257,800 patients via a letter that the laptop that was stolen was secured with a cable lock and the “thief had to cut a lock to take the computer.”

But, according to the center’s internal investigation, “Upon examination found no forced marks were found on or about the card or locking area. No tool marks or other signs of forced removal of the lock were visible.”

David Ping, vice president of strategic planning and business development, said the investigation done by Vassar Brothers’ security department indicated the computer was locked and “when Kroll looked, they saw very clearly the locks had been cut.” Kroll is a New York City-based international risk consulting company.

A separate investigation was conducted in August into the security of laptop computers used as part of the medical barcoding program, in which patients, nurses and medications are issued specific bar code numbers to ensure patients are given the correct medication at the correct time etc. That investigation found three of the 71 laptops without any locks, two that were not locked, one that could not be located and a total of 58 of the 71 cable locks shared the same combination — 000, according to documents.

Ping said Jan. 8 the security procedure for laptops was for them to be locked to the cart and that no laptops were subsequently discovered missing that he was aware of.

He confirmed the locks used were combination locks and “some locks had the same combinations; some had different combinations.”

The investigation into the theft of the laptop says, “When asked if the locks all had the same combination, they (the pc technicians who responded to the initial report of the missing laptop) stated no, each one was unique and that the combinations were documented in a spread sheet.”
Of the August investigation, Ping said, “We had some security issues and we’ve taken care of them and instituted a slew of new procedures, including putting new locks on the laptops.”