DENVER -- Detailed health records of more than 1,600 Colorado families -- containing their most personal information -- are missing, and most of the families don't even know it.
Mickey Ritter feels that the state health department should inform all families whose health information has been stolen.
The records are part of an anonymous autism study and were entered into a laptop computer -- a computer that was stolen from a state health department employee last October when she carelessly left it in her car.
But it wasn't until January of this year that some parents -- who had no idea the data was being collected -- began to find out their family's most private information could be for sale on the open market.
"We received a letter from Boulder Community Hospital notifying us that they had sent our son's records to the state health department, and the records were then stolen in October," said parent Mickey Ritter.
Ritter was stunned because she and more than 1,600 other Colorado families had never been informed that their medical records were even being studied. Notification is not required by state law.
Her son's records were sent as part of an 18-state study of autism, even though her son is perfectly normal.
"They said they had information like Social Security numbers, address, all the intake information that was given about our son which involved complete family medical history and all his health records," Ritter said.
An Aurora police report showed that the health department employee's car was parked in a residential lot when it was stolen. The car was recovered a few days later, but the computer containing the records was missing.
"We go out and collect information on children with autism in order to get an idea of the prevalence of autism in the Denver metro area. That's what this project is about," said Dr. Lisa Miller, the state epidemiologist and division director overseeing the study.
"What shouldn't happen, and the rule that was broken here, was that the laptop was left in a car without that person being there," Miller said.
"The state health department realized they had acted incredibly irresponsibly, leaving these records of 1,600 families in a laptop in a car unprotected, and I think that probably they had to consult with their attorneys and figure out the best way to proceed," Ritter said.
The health department concluded it didn't have to notify the families, instead leaving it up to hospitals and school districts that had initially provided the records for the study.
"We didn't feel we had any legal liabilities since we had been following state law by providing access to the information," said Rick Sheehan, with Boulder Community Hospital.
He said the medical records of 120 children at Boulder Community Hospital were turned over to state researchers.
"We decided we should send notification to Boulder Community Hospital patients that had been involved in this incident because we just felt we had an ethical obligation to let them know what happened," Sheehan said.
Dr. Lisa Miller, the state epidemiologist overseeing the autism study, says the stolen laptop is secure and there is little chance that the health information would get out.
But state health department officials didn't feel that same ethical obligation because they say the stolen laptop had passwords and other important security features so they claim there is little chance of the information getting out.
"We have no evidence that that information has been accessed. We have no evidence that any of that information has come to light ... or that is hasn't," said Miller.
Even so, they contend they have no ethical obligation to inform families.
"I think it's a matter of weighing cost and benefit, and the benefit to you by being notified that this has been stolen when the risk is perceived to be very, very low ... I'm not clear that there is a benefit there," Miller said.
State health department officials claim families have no reason to know their personal records have been stolen and now admit more than 1,200 Colorado families have never been told.
"It just seems so arrogant and irresponsible on the part of an agency that's supposed to be there to serve the public," said Ritter. "And I think that for that to be out there, it feels like a violation and it feels like a lot of exposure."
The fact is, if any of these families has credit or identity problems, they will have no idea whether it is because of the stolen computer.
That's because the state health department is not monitoring the group to detect whether the stolen information is being misused. Only about 340 of the 1,600 families even know they could be at risk.
The ethical question here is: should the state health department decide what is best for you or should you have the right to the information to decide for yourself?