Johns Hopkins Loses Data On 130,000 Patients, Employees

Dynamic security integrated with RFID tracking could have prevented this loss.

An outside contractor lost nine backup tapes that held sensitive personal information on 52,000 workers and 83,000 employees. The data is thought to have been destroyed.

By Sharon Gaudin
InformationWeek

Feb 9, 2007 01:55 PM

Johns Hopkins disclosed this week that it has lost the personal data on roughly 52,000 employees and 83,000 patients.

The Maryland-based organization, which comprises Johns Hopkins University and Johns Hopkins Hospital, has reported that nine backup computer tapes were not returned from a contractor, which routinely takes them and makes microfiche backups of them. Eight of the tapes, according to a notice on Johns Hopkins Web site, contain "sensitive" personal information on employees, and a ninth tape contains "less sensitive" personal information on the hospital's patients.

All nine tapes had been sent to the contractor's Baltimore-area facility on Dec. 21, according to the organization's release. Both the contractor and Johns Hopkins investigated the incident and reportedly determined that the tapes never reached the facility. "It also concluded that it is highly likely that the tapes were mistakenly left by a courier company hired by the contractor at another stop. They were thought to be trash, collected and later incinerated," reads the statement on the Web Site.

Johns Hopkins says it has no evidence that the tapes were stolen or that the information on them has been misused. The statement also calls the risk of identity theft "very, very low."

"Our best information is that the tapes have been destroyed," said William R. Brody, president of Johns Hopkins University, in a written statement. "Nevertheless, we are concerned that there was ever even a possibility that the information on them was out of authorized hands. On behalf of Johns Hopkins, I apologize to all affected employees and patients. We will review our processes and procedures and make any appropriate changes in an effort to ensure that this does not happen again."

University payroll information, including Social Security numbers, and, in some cases, bank account information for present and former employees was among the lost tapes, according to Johns Hopkins. That includes retirees and students who held campus jobs. Employees with information on the lost tapes worked in every university unit, except the Applied Physics Laboratory.

The tape with hospital information held personal information on all new Johns Hopkins Hospital patients first seen between July 4 and Dec. 18, 2006. However, it also has data on any patients who had changed their demographic information in that same time period. The patient information included names and dates of birth. It did not include addresses, Social Security numbers, or financial or medical information, according to Johns Hopkins.

Letters are being sent to all affected Johns Hopkins University employees, current and former, and to all affected Johns Hopkins Hospital patients with available addresses.

Patients may obtain more information at this Web site, and employees may get information at this site.