The unencrypted medical information of about 2,500 participants in a cardiac study conducted by the National Heart, Lung and Blood Institute (NHLBI) may have been compromised by the theft of a laptop PC last month.
The potentially compromised information includes the names, birth dates and hospital medical record numbers of the study participants, as well as data from reports about cardiac MRI procedures performed on them, the NHLBI said in a statement issued Monday. The MRI reports contain information such as heart measurements and diagnoses, according to the statement, which was attributed to NHLBI Director Elizabeth Nabel.
However, Nabel added that no Social Security numbers, addresses, phone numbers or financial data were stored on the laptop. In addition, the system was password-protected. As a result, the theft of the laptop poses a “low likelihood” of identify theft or misuse of financial data, she said.
Nonetheless, Nabel apologized for the failure to encrypt the data on the stolen laptop. And she said that the NHLBI, which is one of the National Institutes of Health (NIH), is working to ensure that all of its researchers have encryption software on their laptops and that they use the technology. (Compare Data Leak Protection products)
“Although the laptop was turned off and password-protected, so that retrieving the confidential information would require considerable computer sophistication, the NHLBI recognizes that such information should not have been stored in an unencrypted form on a laptop computer,” Nabel said as part of the statement.
The Bethesda, Md.-based NHLBI does research on the causes, prevention and treatment of heart, blood and lung diseases. The study in question involved the collection of data from cardiac MRI procedures done from 2001 to last year, using facilities at the NIH and at Bethesda-based Suburban Hospital.
According to a story by The Washington Post on Monday, the laptop was stolen on Feb. 23 from the locked trunk of a car belonging to the laboratory manager who oversees the NHLBI’s cardiac MRI research program.
Nabel’s statement didn’t mention the date of the theft, but it noted that an internal review board at the NHLBI decided March 4 that the participants in the study should be notified of the incident. A notification letter was approved last Thursday and then sent via overnight delivery to each of the affected individuals for whom the institute had a current address.
The statement issued today didn’t explain why the NHLBI took more than two weeks to issue the notices after the review board made the decision that they should be sent out. Officials at the institute didn’t immediately return calls seeking comment on the matter.
As part of its efforts to boost security following the theft, the NHLBI has also “emphasized” to staffers that storing patient names and identifiable medical information on laptops is prohibited, Nabel said. In addition, she said that the institute will continue to “strongly” enforce a requirement that all workers take regular computer security training courses.
The snafu at the NHLBI is just the latest in a long and continually growing list of data compromises resulting from lost or stolen laptops and desktop PCs. The Privacy Rights Clearinghouse, a privacy advocacy group that maintains a chronological list of data breaches, currently counts more than 70 incidents overall since the start of this year. More than one-fourth of them resulted from the loss of computers or storage devices, with about 14 incidents stemming specifically from laptop thefts.
