Johns Hopkins tells patients: Employee stole data for fraud
IDG News Service - Baltimore's Johns Hopkins Hospital is warning more than 10,000 patients about a data theft after linking a woman working in the hospital's patient registration area to fraud.
"Beginning around January 20, 2009, Johns Hopkins received reports, some from individuals themselves, and some through various local law enforcement agencies, that some individuals had determined that they were victims of identity theft and that the theft activities focused in the Baltimore area," the hospital said in an April 3, 2009, letter sent to patients whose data was accessed. The letter was published Monday on the Maryland attorney general's Web site.
After the U.S. Secret Service and U.S. Postal Service got involved, investigators began suspecting that the Johns Hopkins employee was linked to a fraud that involved fake Virginia drivers' licenses, although officials declined to provide more information regarding that alleged scheme.
Law enforcement has identified 46 victims of the scam, 31 of whom were linked to Johns Hopkins. The hospital is offering them credit protection services, and it is also offering similar services to another 526 Virginia patients who may have been targeted by the fraud.
However, most of the 10,200 patients and former patients being notified are thought to be at "extremely low risk" of fraud, according to hospital spokesman Gary Stephenson. "We just contacted them to do due diligence," he said.
The employee had access to the Social Security numbers, names, addresses, dates of birth, telephone numbers, parents' names and medical insurance information of current and former patients. She was not able to learn about the patients' medical conditions, however.
News of the incident was first reported Monday on Databreaches.net, which noted that former Johns Hopkins employee Michelle Johnson had been indicted in January on fraud charges for allegedly using patient data to open fraudulent credit card accounts.
Stephenson said that the Johnson case was separate from this latest incident, but he declined to comment further on the matter, citing an ongoing investigation.
In its notification letter, Johns Hopkins said it has fired the employee it suspects of this latest fraud and expects that she will be indicted. However, the letter warns, "There is no absolute certainty, at this time, that she was the source of the information."
- Securing Mobile App Data - Comparing Containers and App Wrappers Analysts agree that Mobile Device Management (MDM) is not enough when it comes to securing app data. Although it remains a critical component...
- PCI 3.0 Compliance In this white paper, learn how PCI-DSS 3.0 effects how you deploy and maintain PCI compliant networks using CradlePoint devices.
- Mitigating Security Risks at the Networks Edge This white paper provides strategies and best practices for distributed enterprises to protect their networks against vulnerabilities, threats, and malicious attacks.
- 5 Strategies for Modern Data Protection Read the five strategies for modern data protection that will not only help solve your current data management challenges but also ensure that...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!