Johns Hopkins tells patients: Employee stole data for fraud

IDG News Service - Baltimore's Johns Hopkins Hospital is warning more than 10,000 patients about a data theft after linking a woman working in the hospital's patient registration area to fraud.

"Beginning around January 20, 2009, Johns Hopkins received reports, some from individuals themselves, and some through various local law enforcement agencies, that some individuals had determined that they were victims of identity theft and that the theft activities focused in the Baltimore area," the hospital said in an April 3, 2009, letter sent to patients whose data was accessed. The letter was published Monday on the Maryland attorney general's Web site.

After the U.S. Secret Service and U.S. Postal Service got involved, investigators began suspecting that the Johns Hopkins employee was linked to a fraud that involved fake Virginia drivers' licenses, although officials declined to provide more information regarding that alleged scheme.

Law enforcement has identified 46 victims of the scam, 31 of whom were linked to Johns Hopkins. The hospital is offering them credit protection services, and it is also offering similar services to another 526 Virginia patients who may have been targeted by the fraud.

However, most of the 10,200 patients and former patients being notified are thought to be at "extremely low risk" of fraud, according to hospital spokesman Gary Stephenson. "We just contacted them to do due diligence," he said.

The employee had access to the Social Security numbers, names, addresses, dates of birth, telephone numbers, parents' names and medical insurance information of current and former patients. She was not able to learn about the patients' medical conditions, however.

News of the incident was first reported Monday on Databreaches.net, which noted that former Johns Hopkins employee Michelle Johnson had been indicted in January on fraud charges for allegedly using patient data to open fraudulent credit card accounts.

Stephenson said that the Johnson case was separate from this latest incident, but he declined to comment further on the matter, citing an ongoing investigation.

In its notification letter, Johns Hopkins said it has fired the employee it suspects of this latest fraud and expects that she will be indicted. However, the letter warns, "There is no absolute certainty, at this time, that she was the source of the information."