Four lose jobs after data breach at Oregon health care facility

One employee was fired and three others resigned in connection with the theft in late December of backup computer tapes and disks containing personal information and medical records on about 365,000 hospice and home health care patients from a parked car in Portland, Ore.

In an announcement late last week, Providence Home Services, a division of Seattle-based Providence Health System, said the four workers left the company after “a confidential and thorough internal review process of the data storage procedures that led to the theft.” A Providence spokesman confirmed that three of the workers resigned, while one was fired. The spokesman could not confirm the job titles of the workers, but said that all four had jobs related to the data-theft incident.

The theft took place Dec. 31, when a Providence Home Services IT department worker took backup tapes and disks home in his car as part of the home health care division’s backup protocol. The disks and tapes were stolen after they were left in the employee’s car overnight (see ”Update: Thief nabs backup data on 365,000 patients”). The division has since discontinued that backup procedure and brought in more traditional means of protecting data.

Some of the data on the tapes was password-protected at the application level, while the rest of the data was stored in proprietary file formats without password protection. After the incident, the company decided to make all of its data more secure by using additional technologies, including encryption.

Providence notified all affected patients by mail about the theft. The information on the disks and tapes included names, addresses, dates of birth, physicians’ names, insurance data, diagnoses, prescriptions and some lab results. For approximately 250,000 of the patients, Social Security numbers were on the records, according to the company. Some of the records also included patient financial information.

Providence said it has received no verified reports that the stolen data has been used illegally.

The health care group has also reached a deal with security vendor Kroll Inc. to provide Kroll’s ID TheftSmart credit monitoring and restoration services for free to those affected by the theft. ID TheftSmart allows individuals to continuously monitor their credit files, investigates potential identity theft cases and can help identity theft victims restore their identity if data theft occurs.

Starting next week, affected patients will get a letter from Kroll detailing how to sign up for the program.

“We think this will help address the concerns of our patients and their families and help put their minds at ease,” Rick Cagen, CEO of Providence Health System’s Portland Service Area, said in a statement. “We have heard from patients that the process to notify the credit agencies can be difficult, and we appreciate the time they have spent as a result of the theft.”

The data theft incident is under investigation by the Oregon attorney general’s office. A spokesman for the attorney general’s office could not be reached for comment.

Read more news and commentary about data breaches:

• FTC settles with CardSystems over data breach
• Update: N.H. state server eyed in possible credit card data breach
• Bank tape lost with data on 90,000 customers
• Update: Security breach at Sam's Club exposes credit card data
• New York breach notification law goes into effect
• DSW to beef up computer security in FTC settlement
• Lessons learned from corporate security breaches
• Are companies prepared for fallout from a security breach?
• IT Blogwatch -- The best IT blogs on the Net: ChoicePoint fined, but not much
• C.J. Kelly: Employee fired for a data breach?
• Douglas Schweitzer: Time to get physical!
• Security Blogs