More computer thefts were reported this past week…one I’ve already blogged about and numerous others. Just a few of them…
- A briefcase containing U.S. Bank customer information was stolen from the car of one of the bank’s employees. "Bank spokesman Steve Dale said the names, phone numbers and Social Security numbers of a "very small" number of customers were in the briefcase that was stolen in Covington from the employee’s car." This points out the reality that information security incidents and privacy breaches often occur through means other than electronic. People have been stealing paper documents and committing fraudulent acts with them for basically as long as people have figured out how to commit frauds. The bank actually is responding to the incident well compared to other organizations that have experienced incidents. They even called all the people involved instead of just sending a form letter, as most companies have done.
- Theft of laptops, Blackberries, iPods and cellphones is not a U.S. only phenomenon. A story published in Australia today discusses the alarming jump in the number of thefts of these electronics from parked cars. The report indicates over 250 such thefts have occurred since June 1 of this year.
- "…burglars broke into a regional office and stole 10 computers containing names and Social Security numbers for thousands of patients treated" at HCA hospitals in Nashville. "The computers contain 15,000 to 18,000 files with information on Medicare and Medicaid patients who have uncollected co-pays and deductibles." Although the data was NOT encrypted, the computers were password-protected, and were stolen from a locked facility, so it is unlikely, based upon past Department of Health and Human Services (HHS) activities, that any HIPAA noncompliance actions will be pursued. It appears from the report, though, that Internet transmissions may have been made in clear text, so this could lead to a HIPAA infraction if HHS chooses to pursue it.
Technorati Tags
information security
IT compliance
regulatory compliance
stolen computers
HIPAA
patient information privacy
encryption
policies and procedures
awareness and training
privacy