OREGON COMPUTER STOLEN http://www.thenewsguard.com/news/article_5874d9c0-9588-11e2-96ba-0019bb2963f4.html

Stolen OHSU labtop prompts outreach

• Story
• Comments

ShareShare

Print

Create a hardcopy of this page

Font Size:

Default font size

Larger font size

Posted: Monday, March 25, 2013 1:12 pm

0 comments

PORTLAND - Oregon Health and Science University is in the midst of contacting approximately 4,000 patients after a laptop containing some of their personal information was stolen. The laptop was taken during a burglary at an OHSU surgeon's vacation rental home while in Hawaii in late February. Information for 4,022 patients was on the computer.

The computer's desktop and documents folder did not contain sensitive data. All of the patient information was located within the email program. Almost all of the patient information was contained within daily surgery schedules that are emailed to surgeons scheduled to operate in OHSU's operating rooms. Those schedules attached to emails were for surgeries that took place in late 2012 through February 20, 2013. Information located in those daily schedules was limited to:

* Patient names

* OHSU patient medical record numbers

* Type of surgery for each patient

* Surgery dates, times and locations (limited to surgeries in late 2012 through Feb. 20, 2013)

* Patient gender

* Patient age

* Name of the surgeon and anesthesiologist

In addition, OHSU security investigators determined that a small number of the approximately 5,000 emails stored on the laptop contained Social Security numbers for a total of nine patients. Those persons are being offered free identity theft monitoring.

All OHSU laptops are password protected, including the laptop stolen during this burglary. However, at the time of this incident, encryption was required only for laptops used for patient care. Because the laptop in question was purchased and used for research purposes, it was not encrypted. Although the physician wrote and received emails that related to patient care on the laptop, he believed these emails were housed on the OHSU email network – which is secure. However, as is the case with many email programs, recent emails are stored on the computer's hard drive. In an effort to prevent similar issues in the future, OHSU recently enacted even more stringent encryption requirements.

"OHSU believes cash and physical items were the target of the burglars, not the data within the email program on the computer. In addition, based on our analysis of the kind of data on the computer, we believe there is little to no ID theft risk for almost all the patients involved,” explained Ronald Marcum, M.D., M.S., OHSU's chief privacy officer and director of OHSU's Integrity Office. "However, in the interest of patient security and transparency and our obligation to report unauthorized access to personal health information to federal agencies, we are contacting all impacted persons.”

OHSU representatives were unable to immediately contact patients following the theft because there was a significant amount of effort required to determine what was on the stolen computer. OHSU security experts needed to investigate which emails were on the laptop. Then they needed to examine those 5,000 emails individually to identify precisely what data was on the stolen computer and how many people were affected.

OHSU sent letters to the affected patients late last week. Patients who were impacted should receive letters in the mail within a week.

About OHSU

Oregon Health and Science University is the state's only public academic health and research university. As one of Oregon's largest employers with more than 14,000 employees, OHSU's size contributes to its ability to provide many services and community support not found anywhere else in the state. OHSU serves patients from every corner of Oregon and is a conduit for learning for more than 4,400 students and trainees. OHSU is the source of more than 200 community outreach programs that bring health and education services to each county in the state.