Patients of Billing Records Theft at University of Utah Hospitals & Clinics

The University of Utah Hospitals & Clinics is launching a broad-based effort to inform its patients about the recent theft of billing records and to provide them with resources to protect their confidentiality. Additionally, the health-care system, which was already in the process of an independent assessment of its information systems, has taken additional steps to safeguard its records as a result of the theft.

“Although it is unlikely that information on the tapes will be compromised, we are nevertheless taking aggressive steps to protect our patients’ confidentiality,” said Lorris Betz, M.D., Ph.D., Senior Vice President for Health Sciences.

A metal box containing the backup tapes, which contained billing records for approximately 2.2 million patients and guarantors, was stolen on Monday, June 2, from a car belonging to a driver who worked for an independent storage company contracted by the health-care system. The driver violated the protocols his company had established to ensure secure data transportation.

The Salt Lake County Sheriff’s Department, the FBI and the U.S. Postal Service are investigating the theft. “The investigation indicates that the theft was probably a random car burglary, and there is no evidence that the information on the tapes has been accessed or used for identity theft,” said Salt Lake County Sheriff Jim Winder. “Having concluded the first phase of our investigation, we believe it is now time to bring this issue to the public’s attention so that we can enlist their help in recovering the tapes.”

The University of Utah Hospitals & Clinics is offering a $1,000 reward for the return of the tapes, no questions asked. Those wishing to claim the reward may call the Sheriff’s Department at (801) 743-7000.

The billing records included patient names, related demographic information and diagnostic codes. None of the records contained credit card information. Records for a subset of 1.3 million patients also contained Social Security numbers.

The company contracted by the university to transport and store the tapes, Perpetual Storage Inc., said this is the first and only such incident in its 40-year history. It also said that the employee who left the tapes in his car had been with the company for nearly 18 years.

Nevertheless, The University of Utah Hospitals & Clinics has suspended deliveries of backup tapes to Perpetual Storage pending the review of all procedures and protocols for transporting and storing backup data.

Additionally, the health-care system is taking the following steps on behalf of its 2.2 million patients:

• Mailing notification letters to all 2.2 million patients and guarantors;
• roviding free credit monitoring and restoration service to patients whose records included Social Security numbers;
• Providing a toll-free information line at 1-866-581-3599 to respond to questions
• Establishing a website that provides information and resources.