U of U medical records stolen, 2.2 million patients' data at risk

This is an archived article that was published on sltrib.com in 2008, and information in the article may be outdated. It is provided only for personal research purposes and may not be reprinted.

University of Utah Hospital and Clinics patients are bracing for the unknown as police and prosecutors investigate the theft of 2.2 million billing records filled with personal information.

Authorities say the records, stolen out of a courier's personal vehicle earlier this month, put the private data of patients from the past 16 years at risk.

Tuesday's news was especially unsettling for people like Will Taylor, of West Valley City, whose premature daughter is a patient at University Hospital. Taylor has already been the victim of identity theft once, when thieves racked up credit card charges in his name.

Even so, he was not panicking yet.

"I will ask [the hospital] what precautions I can take and what they are doing about it," he said.

Measures so far include offering free credit monitoring services for at least 1.3 million patients whose Social Security numbers were compromised, and a $1,000 reward for the return of the tapes - no questions asked.

Salt Lake County Sheriff Jim Winder and Lorris Betz, a senior vice president for health sciences for University Health Care, say the stolen records were on backup tapes designed to safeguard the records in case materials housed in the hospitals and clinics were destroyed.

The tapes were taken from the vehicle of an employee of Sandy-based Perpetual Storage Inc. near the employee's Kearns home on June 2.

The employee had been assigned to pick up the tapes in a secure company van and transport them to an off-site vault, said James Nowa, a vice president for sales and marketing for Perpetual Storage. He violated company policy by taking them home and leaving them in his car.

A thief then broke into the employee's vehicle near 5200 South and 5000 West, stealing a metal box holding the tapes, Winder said.

Nowa said the 18-year veteran employee has been fired, and the incident is the first of its kind he knows of in the company's 40-year history.

An investigation is ongoing, but the theft appears to be the work of inexperienced criminals who likely believed the metal box containing the tapes was filled with cash, said Winder. After collaborating with the FBI, Winder said it's unlikely the tapes were stolen to commit identity theft.

There's no evidence any of the information on the tapes has been accessed; besides, anyone trying to use the tapes would need specialized equipment to view the contents, Winder said.

But there are also no guarantees.

"If our information isn't safe, then what is?" patient Dan Christenson, of Salt Lake City, said Tuesday after learning of the theft.

Christenson regularly monitors his credit and bank accounts online. He said he now will check those reports more frequently.

Melodie Rydalch, spokeswoman for the U.S. Attorney's Office, said the FBI and the Utah Identity Task Force, which includes local and county law enforcement agencies, is investigating the thefts. She warned of federal penalties for anyone who uses stolen identities.

Betz said the university delayed releasing news of the security breach to the public until the sheriff's office had completed an initial investigation.

"We understand this is unwelcome news to our patients," said Betz.

The university had worked with Perpetual Storage for 12 years before the theft but suspended deliveries after the incident, Betz said. An assessment of university data security policies and procedures is under way, he said.

---

* Tribune reporters PAMELA MANSON and CARLOS MAYORGA contributed to this report.