MIAMI— Computer files holding confidential health and financial information on more than 2.1 million patients at University of Miami health facilities since 1999 were stolen from a storage company contracted to secure the records. UM officials say they believe it is unlikely that the thieves will be able to access the files because of the "complex and proprietary format in which they are written."
"Even though I am confident that our patients’ data is safe, we felt that in the best interest of the physician-patient relationship we should be transparent in this matter,” says Pascal J. Goldschmidt, MD, senior vice president for medical affairs and dean of the University of Miami Miller School of Medicine.
Patients of a UM physician or a UM facility since Jan. 1, 1999, are likely included on the tapes. The data includes names, addresses, Social Security numbers, or health information.
The university will be notifying by mail the 47,000 patients whose data may have included credit card or other financial information regarding bill payment. The box of computer records was stolen on March 17 from a van parked in downtown Coral Gables.
UM hired Terremark Worldwide, a computer security company, to determine the feasibility of accessing and extracting data from a similar set of back-up tapes. "For more than a week my team devised a number of methods to extract readable data from the tapes," says Christopher Day, senior vice president of the Secure Information Services group at Terremark. "Because of the highly proprietary compression and encoding used in writing the tapes, we were unable to extract any usable data." Day says that even if a thief had a copy of the same software used to write the tapes, "it would require certain key data which is not stored on the tapes before the software would make the data readable."
Alan Brill, senior managing director at Kroll Ontrack, a data recovery firm hired by UM to review the theft, says it’s "not impossible to access the data.” But he quickly added "in this case there are many barriers that stand between a thief and being able to actually get usable data from the tapes.”
—John Commins