Third breach for OHSU; third stolen, unencrypted device

A stolen laptop is the source of a data breach of approximately 4,000 Oregon Health & Science University (OHSU) patients. The unencrypted laptop containing their personal health information was stolen from an OHSU surgeon's rented vacation home in February.

Patient data were located within the email program on the laptop, the majority contained in daily surgery schedules that are emailed to surgeons, according to hospital officials. The laptop included the personal health information of 4,022 patients, including patient names, genders, dates of birth, medical record numbers, type of surgery, surgery dates and locations and patients' surgeons.   

In addition, OHSU security investigators determined that a small number of the approximately 5,000 emails stored on the laptop contained Social Security numbers for a total of 17 patients. Encryption was required at OHSU only for laptops used for patient care. Because the laptop in question was purchased and used for research purposes, it was not encrypted.

"OHSU believes cash and physical items were the target of the burglars, not the data within the email program on the computer. In addition, based on our analysis of the kind of data on the computer, we believe there is little to no ID theft risk for almost all the patients involved,” said Ronald Marcum, MD, OHSU's chief privacy officer and director of OHSU's Integrity Office, in a statement. "However, in the interest of patient security and transparency and our obligation to report unauthorized access to personal health information to federal agencies, we are contacting all impacted persons.”  

This is OHSU's third reported HIPAA breach involving more than 500 individuals since 2009. The other incidents also involved stolen and unencrypted devices.