[Dataloss] (update) UT: U. patient records recovered

[Jake Schroeder]

Sheriff: One arrest, two additional suspects located in U. patient records theft

Three people have been identified as suspects -- with one under arrest -- in the June theft of tapes containing University of Utah patient billing records, which have been recovered and do not appear to have been accessed, Salt Lake County Jim Winder said.
    Shadd Dean Hartman, 37, was booked into the Salt Lake County Jail early Wednesday on suspicion of possession of stolen property and unlawful possession of another's identification in connection with the theft.
    A second person is already in custody on unrelated charges and being interviewed; and the third person is expected to be booked into jail by the end of the day, Winder said. He did not rule out further arrests.
    They were stolen in early June after a courier for the U.'s contract storage company, Perpetual Storage, left them in his personal vehicle overnight outside his home in Kearns. He violated company policy by not taking them to the company's vault in Little Cottonwood Canyon.
    The group became aware of what they allegedly had - and a $1,000 reward - through media coverage of the theft, Winder said. But he said they did not appear to have the ability to access the information on the tapes.
    "They're not techies," Winder said. "I don't know if they could find their rear end with both hands."
    Hartman, 37, of Erda,Tooele County, has a criminal record dating back to 1992, according to state court records. It includes convictions for forgery, theft by receiving stolen property, drug possession and operating clandestine drug labs.
    The most recent case was filed in February by Tooele County prosecutors, who charged him in 3rd District Court with third-degree felony forgery and three counts of misdemeanor theft.
    The judge in that case issued a $20,000 warrant for Hartman's arrest after he twice failed to appear in court.
    The stolen tapes, containing personal information for 1.5 million patients, included driver license numbers, birth dates, physicians' names, insurance providers and medical procedure codes. In addition, Social Security numbers were listed for 953,000 patients.
    The tapes will be examined by the FBI, Winder said. He said the probability the tapes were accessed by the group was about 2 on a scale of one to ten, but added that even the FBI examination may not provide a definite answer.
    The U. has posted the following information on its Web site:
    "The tapes were recovered in their original container and condition and there is no indication that the information on the tapes has been accessed or misused."
    The U., which is offering free credit monitoring to some affected patients, said it will "keep our current measures in place" since the investigation is ongoing.
    The backup tapes contained billing records dating back to 1992.
    There is an individual the sheriff's office believes should receive the reward, Winder said, but he declined to identify the individual.
    Winder said the courier will not face charges and is instead considered a victim in the case.
    The U. has offered patients whose Social Security numbers were compromised one year of credit monitoring with a one year $25,000 "identity theft insurance."
    Plaintiffs in two lawsuits that are seeking class-action status say that isn't enough.
    They fear the possible theft of their personal information could result in a host of problems: ruined credit that could cost them jobs, loans and housing; being blackmailed to avoid the disclosure of sensitive medical information like HIV-positive status or drug addiction treatment; being issued a warrant for a DUI after their driver's license number was misused; being held responsible for taxes if their personal information is used to get a job.
    One lawsuit filed by Christensen & Jensen against Perpetual Storage and the U. demands the university extend credit monitoring for at least five years; offer five years worth of fraud protection that would alert patients before new lines of credit are opened; and provide victims money and legal counsel to restore their credit and identities and money to reimburse them for money lost due to identity theft.
    Before this afternoon's news conference, attorney Scot Boyd, who is representing 11 plaintiffs and potentially "hundreds" more in that lawsuit, couldn't say whether the recovery of the tapes would nullify the lawsuit. But in court filings, he wrote that it wouldn't, noting the thieves could copy the information and return the original tapes.
    In a separate lawsuit against Perpetual, patient Thelma Keachie demands $8 million to monitor and repair credit reports for at least five years and track the use of other private information for a lifetime.


Jake Schroeder