Johns Hopkins loses 135,000 worker, patient records

Computerworld - Computer backup tapes containing payroll data on 52,000 Johns Hopkins workers and medical information on 83,000 patients were lost last month but are thought to have been destroyed, the university and hospital announced yesterday.

Nine backup tapes that were shipped in late December by courier to a Baltimore-area contractor for conversion to microfiche were never returned, Johns Hopkins authorities said in letters and e-mails sent to former patients and current and former employees. On Jan. 18, Johns Hopkins discovered that the tapes had not been returned. Normally, backup tapes and the resulting microfiche are received within two weeks of their reaching the contractor.

"The investigation concluded that the tapes never reached the contractor. Johns Hopkins believes that the courier mistakenly left the box containing the tapes at another stop," the university said in a statement. "The shipping area at that other stop is generally full of boxes which are placed in a dumpster. Johns Hopkins believes it is highly likely that the tapes were thought to be trash, collected, and incinerated."

Eight of the nine tapes contained payroll information on 20,000 former and 32,000 current employees of Johns Hopkins University. The data on the unencrypted tapes included employee names, Social Security numbers, birth dates and -- in cases where employees were paid by direct deposit -- bank account information.

The ninth backup tape contained the names of 83,000 hospital patients, their parents' names, race, sex, date of birth and medical record numbers. The patients affected were seen between July 4 and Dec. 18, 2006, the university said.

"Our best information is that the tapes have been destroyed," William Brody, president of Johns Hopkins University, said in a statement yesterday. "Nevertheless, we are concerned that there was ever even a possibility that the information on them was out of authorized hands. I apologize to all affected employees and patients. We will review our processes and procedures and make any appropriate changes in an effort to ensure that this does not happen again."

The school and hospital have set up Web sites and toll-free telephone numbers to answer questions from workers and patients.

Data losses involving universities and health care organizations aren't unusual. According to the Privacy Rights Clearinghouse, which tracks breaches and other data misadventures, the most recent large loss to a university was a Feb. 2 disclosure by the University of Missouri about a January hack that involved files on nearly 4,000 researchers. On Jan. 26, meanwhile, tapes containing records of 50,000 members of Virginia-based Anthem Blue Cross Blue Shield were stolen from a lock box.

Read more about Security in Computerworld's Security Topic Center.