In December 2005, a thief broke into Steven Shields’ car outside his Oregon home and walked off with unencrypted computer disks and tapes containing personal information on 365,000 patients of Providence Health System.
The breach was the largest of its kind in Oregon and led to a class-action lawsuit against the Portland-based healthcare provider. A nine-month investigation by the state attorney general into delays in notifying affected individuals ended with Providence Health agreeing to pay $95,000 to settle patient claims.
Now, in a new twist in the case, Shields — a former IT worker at Providence Health — has filed a wrongful termination lawsuit claiming that he was fired in February 2006 simply because he reported the theft to law enforcement officials.
The lawsuit, filed late last month in Multnomah County Circuit Court, seeks $1 million in damages for lost wages and emotional distress caused by the firing.
“Steve was a 10-year employee with a good record,” said Kevin Keaney, an attorney for Shields.
The theft occurred on Dec. 30 or 31 in 2005, but affected people were not notified until the end of January 2006. Shields was fired the following month.
Keaney noted that the lawsuit was filed under Oregon’s whistle-blower law, which forbids companies from firing employees for filing a report to law enforcement authorities.
Keaney said that Shields had transported the patient data tapes to his home as part of the company’s backup protocol.
A spokesman from Providence Health confirmed the legal dispute but declined to comment further because the lawsuit is pending.
Shields was one of four Providence Health IT employees to lose their jobs following the incident.
Providence Health has until later this month to formally respond to the lawsuit.
