Paying the Price for a Security Compromise

Earlier this year, the billing records of 2.2 million patients at the University of Utah Hospitals and Clinics were stolen. A metal box, which contained tapes that housed the billing records – including Social Security Numbers for 1.3 million patients dating back 16 years -, was stolen from a vehicle after a courier failed to immediately take the box to a storage area. The courier worked for an off-site storage company, with which the hospital contracted to hold copies of records for disaster recovery purposes. The courier was supposed to immediately deliver the tapes from the hospital to the offsite storage facility, but instead brought the tapes home and left them in the company van from which they were later stolen. While it is presumed that the thief was not after the patient records, and probably thought the box contained cash, the fact remains that the box was stolen and the information potentially compromised. 

A short time after the robbery occurred, the tapes were recovered in their original container with no indication that patient information had been accessed or misused. Despite this fact, a class action law suit against the University of Utah has been proposed, which would include all individuals whose information was lost in the theft. As of this writing, the court has not made its decision regarding whether the law suit will stand.¹

Reference