If you can't trust Johns Hopkins ...

[David Farber <dave () farber net>]

Begin forwarded message:

From: Randall <rvh40 () insightbb com>
Date: May 17, 2009 12:21:20 PM EDT
To: David Farber <dave () farber net>, johnmacsgroup () yahoogroups com
Subject: If you can't trust Johns Hopkins ...

Insider May Have Breached More Than 10,000 Patient Records At Johns  
Hopkins

Employee had access to patient database as part of her job, report says
May 13, 2009 | 04:03 PM
By Tim Wilson
DarkReading

An employee at Johns Hopkins Hospital may have leaked the personal  
information of more than 10,000 patients in an identity fraud scam.
According to a report filed to the administrator of the state of  
Maryland's Identity Theft Program (PDF), some 31 individuals with  
connections to Johns Hopkins have reported identity thefts since Jan.  
20. Law enforcement agencies suspect the thefts might be part of a  
fraudulent driver's license scheme discovered in neighboring Virginia.
In researching the thefts, members of the Johns Hopkins security  
department discovered that a single employee who worked in patient  
registration may have used her access privileges to review data on  
more than 10,000 patients while working at the hospital. The now- 
former employee is expected to be indicted for stealing the data, the  
report states.
The hospital emphasizes that the breach was not a hacking incident,  
but that the employee had access to the records as part of her job.
Johns Hopkins is offering credit monitoring and fraud resolution  
services, as well as $30,000 in identity theft reimbursements, to the  
31 victims, as well as to any of the 526 Virginia residents in the  
database who report fraud. It also is notifying the other 10,000  
patients whose records were in the database.
The hospital says the patient registration database contains no  
medical records, but it does contain sensitive data, such as addresses  
and Social Security numbers. Johns Hopkins officials say they do not  
know if the database was the source of the identity thefts, but are  
notifying all of those involved as a precaution.
This is not the first time Johns Hopkins has experienced data theft by  
an insider. In 2007, officials at Johns Hopkins University reported  
that a contractor did not return backup tapes from the hospital and  
university payroll. Some 135,000 employees and former patients had to  
be notified. The data was not encrypted.
And in January, a Johns Hopkins employee was arrested in connection  
with the theft of patient data. News reports quoted a hospital  
spokesperson saying the number of victims in that case was "probably  
less than 10."
Have a comment on this story? Please click "Discuss" below. If you'd  
like to contact Dark Reading's editors directly, send us a message.

http://www.darkreading.com/insiderthreat/security/privacy/showArticle.jhtml?articleID=217400831




--
The war on privilege will never end. Its next great campaign will be  
against the privileges of the underprivileged. H. L. Mencken





-------------------------------------------
Archives: https://www.listbox.com/member/archive/247/=now
RSS Feed: https://www.listbox.com/member/archive/rss/247/
Powered by Listbox: http://www.listbox.com