An Indiana-based hospital system has started notifying at least 260,000 patients of its Indiana and Illinois hospitals that a medical records contractor had lost CDs containing their Social Security numbers and other personal information.
Officials of the Sisters of St. Francis Health Services, however, say the lost CDs were recovered and that they do not believe any of the information was improperly accessed.
A letter to patients of the Mishawaka, Ind.-based St. Francis, which operates 10 hospitals in Indiana and two in Illinois, said that in July an employee of a medical billing contractor copied the data onto several CDs and placed them in a new computer bag to work on the data from home.
That employee later decided the bag was too small and exchanged it at a store, accidentally leaving the discs inside, the letter said.
Lisa Decker, a spokeswoman for St. Francis subsidiary Greater Lafayette Health Services, said the person who later bought the bag immediately returned the discs to the company and that officials were confident the data was not accessed.