Laptop with info on heart patients stolen from federal researcher

Comments

Related

Active Comments

Anonymous says: Every time I see comments like the ones in this story, it's a red flag for how lax the security...

Read the rest | Reply

Anonymous says: since it aint encrypted can a person jus take out the hd and connect it using an external hd and...

Read the rest | Reply

All Comments (2) | Post New

• Is there a hidden cost to data protection?
• Global News Update: Monday, December 1, 2008
• NHS' grim catalogue of data breaches
• Global Dispatches
• Who's been reading my cell-phone records?

Zone

The Security Zone With the mobility of employees and the ease with which external devices can be brought in and out of a network, continuing to build your security plan for network servers and clients is a must. Fortunately, there is much that organizations can do to protect themselves from attacks - internal and external. Having the right policies, procedures and server configurations is critical... Learn more in The Security Zone See All Zones

March 24, 2008 (Computerworld) Unencrypted medical information of about 2,500 participants in a cardiac study conducted by the National Heart, Lung and Blood Institute (NHLBI) may have been compromised by the theft of a laptop PC last month.

The potentially compromised information includes the names, birth dates and hospital medical record numbers of the study participants, as well as data from reports about cardiac MRI procedures performed on them, the NHLBI said in a statement issued today. The MRI reports contain information such as heart measurements and diagnoses, according to the statement, which was attributed to NHLBI Director Elizabeth Nabel.

However, Nabel added that no Social Security numbers, addresses, phone numbers or financial data were stored on the laptop. In addition, the system was password-protected. As a result, the theft of the laptop poses a "low likelihood" of identify theft or misuse of financial data, she said.

Nonetheless, Nabel apologized for the failure to encrypt the data on the stolen laptop. And she said that the NHLBI, which is part of the National Institutes of Health (NIH), is working to ensure that all of its researchers have encryption software on their laptops and that they use the technology.

"Although the laptop was turned off and password-protected, so that retrieving the confidential information would require considerable computer sophistication, the NHLBI recognizes that such information should not have been stored in an unencrypted form on a laptop computer," Nabel said as part of the statement.

The Bethesda, Md.-based NHLBI does research on the causes, prevention and treatment of heart, blood and lung diseases. The study in question involved the collection of data from cardiac MRI procedures done from 2001 to last year at NIH facilities and at Bethesda-based Suburban Hospital.

According to a story published by The Washington Post on Monday, the laptop was stolen on Feb. 23 from the locked trunk of a car belonging to the laboratory manager who oversees the NHLBI's cardiac MRI research program.

Nabel's statement didn't mention the date of the theft, but it noted that an internal review board at the NHLBI decided March 4 that the participants in the study should be notified of the incident. A notification letter was approved last Thursday and then sent via overnight delivery to each of the affected individuals for whom the institute had a current address.

The statement issued today didn't explain why the NHLBI took more than two weeks to issue the notices after the review board made the decision that they should be sent out. Officials at the institute didn't immediately return calls seeking comment on the matter.

As part of its efforts to boost security following the theft, the NHLBI has also "emphasized" to staffers that storing patient names and identifiable medical information on laptops is prohibited, Nabel said. In addition, she said that the organization will continue to "strongly" enforce a requirement that all workers take regular computer security training courses.