Information on 47,000 UM patients stolen

April 17, 2008

By John Dorschner

http://www.miamiherald.com/news/breaking_dade/story/499492.html


The confidential information of tens of thousands of University of Miami patients was stolen last month when thieves took a case out of a vehicle used by a private off-site storage company, UM said Thursday morning

"Anyone who has been a patient of a University of Miami physician or visited a UM facility since Jan. 1, 1999, is likely included on the tapes," the university said in a news release. "The data included names, addresses, Social Security numbers or health information. The university will be notifying by mail the 47,000 patients whose data may have included credit card or other financial information regarding bill payment."

The information was in a container holding computer back-up tapes. The container was removed from a vehicle in downtown Coral Gables on March 17, the storage company told UM.

"Shortly after learning of the incident, the university determined it would be unlikely that a thief would be able to access the backup tapes because of the complex and proprietary format in which they were written," UM said in the statement.

"Even so, the university engaged leading computer security experts at Terremark Worldwide to independently ascertain the feasibility of accessing and extracting data from a similar set of backup tapes," UM reported.

A Terremark executive, Christopher Day, said that after a week of trying to extract the data, it couldn't do so. "Because of the highly proprietary compression and encoding used in writing the tapes, we were unable to extract any usable data," Day was quoted as saying in the news release.

UM then asked Alan Brill, senior managing director at Kroll Ontrack, to review the testing. "While the report shows it is not impossible to access the data, in this case there are many barriers that stand between a thief and being able to actually get usable data from the tapes," the report quoted Brill as saying.

In its release, UM said it has created a website for information about the incident: www.dataincident.miami.edu. Patients can also contact a call center at 1-866-628-4492.


main page ATTRITION feedback