Wake County Emergency Medical Services officials waited eight days to file a formal report on the suspected theft of a laptop containing names, addresses and Social Security numbers of as many as 850 patients transported by county ambulances.
A Panasonic Toughbook used by county paramedics to store patient information on ambulance runs went missing from the WakeMed emergency department Jan. 17 and now is thought to have been stolen, according to a WakeMed Campus Police report dated Friday.
The patient information was not cloaked by encryption, said Jeff Hammerstein, Wake EMS district chief. Computer experts say the lack of encryption makes it easier for identity thieves to access patient data from the laptop's hard drive.
On Monday, county officials were preparing letters with news of the potential risk to be sent to patients whose confidential information was stored in the laptop. County officials tracked down those patients from a central database.
"We regard this as a pretty serious thing," said Wake EMS Chief Skip Kirkwood. "It's far more annoying than I'd like the situation to be."
Annie Ant-n, a N.C. State University computer science professor who specializes in data theft, said county EMS officials waited too long to report the missing computer to hospital police. She said they should have reported the theft as soon as they discovered the laptop was missing and should have notified patients whose confidential information was stored inside.
"It's concerning that eight days passed before they filed their police report," Ant-n said.
Because the laptop went missing from WakeMed's campus, the hospital could be exposed to legal action if the personal information is used fraudulently, Ant-n said. The potential theft of patient information could be seen as a violation of the hospital's privacy policy, she said.
"If they violated that policy, they're liable," Ant-n said.
The $4,000 computer was left unattended in a battery charger at a work station used by paramedics to file reports, according to the hospital police report, and was last seen around 5 p.m. on Jan. 17.
Wake EMS conducted an extensive search of WakeMed and the Wake EMS facilities, hoping to find the missing Toughbook. They asked hospital police to check security cameras to aid the search, but waited until Friday to file a formal theft complaint.
While the sensitive patient data was not encrypted, Wake EMS officials said it was protected by several lesser layers of security.
For the last several years, Wake County paramedics have used laptops to quickly process patient information from the scene of a call or while en route to the hospital.
Once at the hospital, the laptops are connected to a docking station to download diagnostic information to a hospitalwide database. The laptop also connects to a separate database the county uses to store insurance and billing information. That's the information identity thieves covet.
N.C. State's Ant-n said patients whose information was stored in the missing laptop should ask their bank and credit card companies to place a fraud alert on their accounts.
Meanwhile, Wake County will cross its fingers and continue to look for the laptop at WakeMed and at other EMS organizations.
"I remain hopeful that its been put in a drawer somewhere," Kirkwood said.