PORTLAND, Ore. – Oregon Health and Science University is contacting more than 4,000 patients after a laptop containing some of their personal information was stolen from a vacation rental home in Hawaii last month.
Information from 4,022 patients was on the computer, according to OHSU spokesman Jim Newman. The surgeon who had the computer was using it for research purposes, so it was not encrypted
“Almost all of the patient information was contained within daily surgery schedules that are emailed to surgeons scheduled to operate in OHSU's operating rooms. Those schedules attached to emails were for surgeries that took place in late 2012 through February 20, 2013,” a news release said.
Information contained in the schedules included names, medical record numbers, types of surgeries, dates of surgeries, and names of surgeons.
OHSU security investigators said nine patients’ social security numbers were included in some of the emails on the laptop. Those patients are being offered free identity theft monitoring, Newman said.
“OHSU believes cash and physical items were the target of the burglars, not the data within the email program on the computer. In addition, based on our analysis of the kind of data on the computer, we believe there is little to no ID theft risk for almost all the patients involved,” said Ronald Marcum, M.D., M.S., OHSU's chief privacy officer and director of OHSU's Integrity Office. "However, in the interest of patient security and transparency and our obligation to report unauthorized access to personal health information to federal agencies, we are contacting all impacted persons.”
The hospital was not able to contact patients immediately after the theft because they said it took time to determine what was on the stolen computer.
OHSU sent letters to all affected patients late last week. Patients should receive them soon.
Newman said OHSU recently enacted “even more stringent encryption requirements.”
This wasn’t the first time an OHSU laptop containing personal information was stolen. A doctor’s computer was stolen out of his parked car at his Washington County home in 2009. That computer was password-protected and didn’t contain patients’ social security numbers.
In 2008, an OHSU laptop containing records of nearly 900 patients was stolen from a motel. A hospital spokesperson said those records were quickly deleted.