Powered By InformationWeek Business Technology Network
 
Welcome Guest. | Log In| Register | Membership Benefits
  • Email this page E-mail this page
  • |  Print Print this page
  • |   Bookmark and Share

Insider May Have Breached More Than 10,000 Patient Records At Johns Hopkins

Employee had access to patient database as part of her job, report says

May 13, 2009 | 04:03 PM

By Tim Wilson
DarkReading

An employee at Johns Hopkins Hospital may have leaked the personal information of more than 10,000 patients in an identity fraud scam.

According to a report filed to the administrator of the state of Maryland's Identity Theft Program (PDF), some 31 individuals with connections to Johns Hopkins have reported identity thefts since Jan. 20. Law enforcement agencies suspect the thefts might be part of a fraudulent driver's license scheme discovered in neighboring Virginia.

In researching the thefts, members of the Johns Hopkins security department discovered that a single employee who worked in patient registration may have used her access privileges to review data on more than 10,000 patients while working at the hospital. The now-former employee is expected to be indicted for stealing the data, the report states.

The hospital emphasizes that the breach was not a hacking incident, but that the employee had access to the records as part of her job.

Johns Hopkins is offering credit monitoring and fraud resolution services, as well as $30,000 in identity theft reimbursements, to the 31 victims, as well as to any of the 526 Virginia residents in the database who report fraud. It also is notifying the other 10,000 patients whose records were in the database.

The hospital says the patient registration database contains no medical records, but it does contain sensitive data, such as addresses and Social Security numbers. Johns Hopkins officials say they do not know if the database was the source of the identity thefts, but are notifying all of those involved as a precaution.

This is not the first time Johns Hopkins has experienced data theft by an insider. In 2007, officials at Johns Hopkins University reported that a contractor did not return backup tapes from the hospital and university payroll. Some 135,000 employees and former patients had to be notified. The data was not encrypted.

And in January, a Johns Hopkins employee was arrested in connection with the theft of patient data. News reports quoted a hospital spokesperson saying the number of victims in that case was "probably less than 10."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.


Subscribe to RSS



Insider Threat Reports

report Inside Out: Protecting Your Partnerships -- and Your Data
Today's businesses depend on e-commerce among partners, but allowing third parties to access internal networks may endanger your data. How can IT security pros ensure that contractors, supplies and others get the access they need -- without becoming threats? This report offers some answers.

report Rotten Apples: How To Detect And Stop Malicious Insiders In Your Organization
Most data leaks are unintentional - but in every enterprise, there are a few hard cases that defy this truism and threaten the very heart of your data.What can you do to stop these rotten apples from using their intimate knowledge of your organization - and its data access methods - to wreak havoc? This report offers a detailed look at how malicious insiders might attack your data, how they’re motivated, and what you can do to stop them.

report Understanding The Insider Threat
Think you know your trusted users? Think again. The availability of new Internet technologies and the pressures of a spiraling economy are changing the nature of the data breach, and your employees may have their fingers on the trigger. This report offers a look at the full spectrum of insider threats, and the risks associated with each.

report Well-Meaning Employees -- And How To Stop Them
The most dangerous threat to your data isn't hackers or criminal insiders: it's the well-meaning employee, whose missteps may lead to the unintentional leak of your most sensitive corporate data. Learn how employees accidentally expose sensitive information, and how you can keep those good intentions from paving the road to your company's ruin.