[Dataloss] Tapes stolen containing patient info of 47,000

[rchick]

April. 17, 2008
BY John Dorschner
http://www.miamiherald.com/news/breaking_dade/story/499492.html

The confidential information of tens of thousands of University of Miami
patients was stolen last month when thieves took a case out of a vehicle
used by a private off-site storage company, UM said Thursday morning

'' Anyone who has been a patient of a University of Miami physician or
visited a UM facility since Jan. 1, 1999, is likely included on the tapes,''
the university said in a news release. ``The data included names, addresses,
Social Security numbers or health information. The university will be
notifying by mail the 47,000 patients whose data may have included credit
card or other financial information regarding bill payment.''

The information was in a container holding computer back-up tapes. The
container was removed from a vehicle in downtown Coral Gables on March 17,
the storage company told UM.

''Shortly after learning of the incident, the university determined it would
be unlikely that a thief would be able to access the backup tapes because of
the complex and proprietary format in which they were written,'' UM said in
the statement.

''Even so, the university engaged leading computer security experts at
Terremark Worldwide to independently ascertain the feasibility of accessing
and extracting data from a similar set of backup tapes,'' UM reported.

A Terremark executive, Christopher Day, said that after a week of trying to
extract the data, it couldn't do so. ''Because of the highly proprietary
compression and encoding used in writing the tapes, we were unable to
extract any usable data,'' Day was quoted as saying in the news release.

UM then asked Alan Brill, senior managing director at Kroll Ontrack, to
review the testing. ''While the report shows it is not impossible to access
the data, in this case there are many barriers that stand between a thief
and being able to actually get usable data from the tapes,'' the report
quoted Brill as saying.

In its release, UM said it has created a website for information about the
incident: www.dataincident.miami.edu. Patients can also contact a call
center at 1-866-628-4492.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://attrition.org/pipermail/dataloss/attachments/20080417/a15471e7/attachment.html