OHSU notifies patients of laptop theft

Oregon Health & Science University in Portland is in the process of contacting about 4,000 patients after the theft of a surgeon's laptop containing some of their personal information.

The laptop was taken in late February during a burglary at a surgeon's vacation rental home in Hawaii. Though the desktop and documents folder did not contain sensitive data, daily surgery schedules containing information about patients who underwent surgery between late 2012 and Feb. 20, 2013, were located within the e-mail program.

E-mails included patient names, ages, gender and medical record numbers; types of surgery; surgery dates, times and locations; and name of the surgeon and anesthesiologist. A small number of these e-mails, affecting nine patients, also contained their Social Security numbers. OHSU has offered free identity theft monitoring to those patients.

According to a statement posted on the OHSU website, all organization laptops, including the stolen one, are password-protected. However, at that time, encryption had not been required for all laptops, so recent e-mails stored on the computer's hard drive were accessible, even if their retrieval was not the goal of the theft.

“OHSU believes cash and physical items were the target of the burglars, not the data within the e-mail program on the computer. In addition, based on our analysis of the kind of data on the computer, we believe there is little to no ID theft risk for almost all the patients involved,” Dr. Ronald Marcum, OHSU's chief privacy officer and director of OHSU's integrity office, said in the Web statement. “However, in the interest of patient security and transparency and our obligation to report unauthorized access to personal health information to federal agencies, we are contacting all impacted persons.”

OHSU is sending letters to the 4,022 patients affected by the data breach, but a toll-free phone line and list of frequently asked questions have been made available for concerned patients.