JACKSONVILLE, Fla. – Three unencrypted computer backup tapes containing patient billing and employee payroll data were reported missing from a Nemours Children's Clinic facility in Wilmington, Del., according to a news release.
The tapes were stored in a locked cabinet following a computer systems conversion completed in 2004. The tapes and locked cabinet were reported missing on Sept. 8 and are believed to have been removed on or about Aug. 10 during a facility remodeling project, officials said.
Recommended Videos
There is no indication that the tapes were stolen or that any of the information on them has been accessed or misused, officials said. Independent security experts retained by Nemours determined that highly specialized equipment and specific technical knowledge would be necessary to access the information stored on these backup tapes, officials said.
They said there are no medical records on the tapes."This is an isolated incident unrelated to patient care and safety," said David J. Bailey, M.D., President and Chief Executive Officer, in the news release. "The privacy of our patients, their families and our employees and business partners is a high priority to all of us at Nemours."
The information on the tapes dates principally between 1994 and 2004 and relates to about 1.6 million patients and their guarantors, vendors and employees at Nemours facilities in Florida, Delaware, Pennsylvania and New Jersey.
The missing backup tapes contained information such as name, address, date of birth, Social Security number, insurance information, medical treatment information and direct deposit bank account information.
Jacksonville mother Sarah Phelps said she has already received two letters from Nemours and may receive to more for her other two children.
She said that when looking over the letters, she can't help but think, "They're little kids. They're not supposed to worry about this kind of stuff.""I can understand their concerns," Bailey said in a phone interview Monday. "In fact, my information is on those tapes as well."
Nemours said it is notifying individuals who may have been affected and offering them one year of free credit monitoring and identity theft protection as well as call center support.
Additionally, Nemours is taking immediate steps to strengthen its data security practices, officials said. These include moving towards encrypting all computer backup tapes and moving nonessential computer backup tapes to a secure off-site storage facility.
Channel 4 crime analyst Ken Jefferson said that everyone who receives a letter should take advantage of the credit monitoring and identity theft protection. He said even if children are very young, anyone could try to use their Social Security number to apply for credit cards."
Constantly monitor your credit report. Constantly monitor your statements to see if there's any discrepancy whatsoever," Jefferson said. "Never ever underestimate the talents of a hacker."
Nemours said it began mailing letters on Oct. 7 to all patients who were affected. All letters will be mailed no later than Oct. 26.
If you believe you were affected and do not receive a letter by Oct. 31, call 855-755-8483 Monday through Friday between 8 a.m. and 5 p.m. and refer to #6366100711 when prompted.
All addresses have been processed through the U.S. Postal Service's National Change of Address database, so patients do not have to call to update their information unless they do not receive a letter by Oct. 31.