A government laptop computer containing sensitive medical information on 2,500 patients enrolled in a National Institutes of Health study was stolen in February. The information was not encrypted, in violation of the government’s data-security policy.
At risk are seven years of clinical trial data, including names, medical diagnoses and details of the patients’ heart scans.
NIH officials made no public comment about the theft and did not send letters notifying the affected patients of the breach until Thursday, almost a month later. They said they hesitated because of concerns that they would provoke undue alarm.
The handling of the incident is reminiscent of a 2006 theft from the home of a Department of Veterans Affairs employee of a laptop with personal information about veterans and active-duty service members. In that case, VA officials waited 19 days before announcing the theft.
The incident is the latest in a number of failures by government employees to properly secure personal information. This month, the Government Accountability Office found that at least 19 of 24 agencies reviewed had experienced at least one breach that could expose people’s personal information to identity theft.
Elizabeth Nabel, director of the National Heart, Lung and Blood Institute, said in a statement issued late Friday that “when volunteers enroll in a clinical study, they place great trust in the researchers and study staff, expecting them to act both responsibly and ethically.” She said, “We deeply regret that this incident may cause those who have participated in one of our studies to feel that we have violated that trust.”
NIH officials said the laptop was taken Feb. 23 from the locked trunk of a car driven by an institute laboratory chief named Andrew Arai, who had taken his daughter to a swim meet in Montgomery County, Md. They called it a random theft.
Arai oversees the institute’s research program on cardiac magnetic resonance imaging and signed the letters to those whose data was exposed.
In the letter, Arai told the patients that “some personally identifiable information” was on the stolen computer, including names, birth dates, hospital medical record numbers and MRI information reports, such as measurements and diagnoses. Social Security numbers, phone numbers, addresses and financial information were not on the laptop, officials said.
Arai’s letter said that the NIH Center for Information Technology determined that the theft posed “a low likelihood of identity fraud” or financial harm.
An initial effort by information technology personnel failed to encrypt the laptop before it was stolen and Arai neglected to follow up, according to institute spokeswoman Susan Dambrauskas.
