The confidential medical records of more than 300,000 Providence Health System patients were stolen from an employee's minivan last month, the Clackamas County (Ore.) Sheriff's Office said.
The records were stored on computer disks and digital tape that a Providence information systems analyst took home to Milwaukie, Ore., said Detective Wendi Babst, a sheriff's spokeswoman. A thief had broken a window to gain access to the items. Providence officials said it was customary for a manager or supervisor to take copies home as a readily available backup.
The records, which were not encrypted, contained names, addresses, Social Security information and sensitive health information. The Seattle-based not-for-profit said the records included only home health patients, some dating back to 1987, and about 1,500 current and former employees of the home health division. The patients were from Oregon and Washington. No hospital, clinic or health plan records were among those stolen.
The Oregon attorney general's office said that Providence may have violated state law. An organization that compiles identity information on people must take reasonable measures to ensure against such a breach, said Jan Margosian, a spokeswoman for the office. The attorney general's office also questioned why it took Providence more than three weeks to notify patients about the theft, which was reported on Dec. 31, 2005.