Social Security numbers and other personal data on more than 6,000 employees and retirees of Tuscaloosa, Ala.-based DCH Health System are missing after a consulting company lost a computer disk and documents containing the information.
The hospital system notified employees of the breach last Thursday. The loss could affect anyone on the payroll last year at DCH Regional Medical Center, Northport (Ala.) Medical Center or Fayette (Ala.) Medical Center.
While the data have been missing since last month, DCH said it did not notify workers of the breach until it had in place a program to help protect against possible identity theft linked to the loss.
An encrypted disk and papers containing employees' personal identification information were lost in early March by Mercer Human Resources Consulting, the company that reviews DCH's pension plan to determine annual employer contribution requirements.
Mercer, an arm of Marsh & McLennan Cos., is paying for one year of identity-theft monitoring for everyone affected. The identity monitoring is being provided by Kroll, another Marsh & McLennan company.