[ISN] Insider May Have Breached More Than 10, 000 Patient Records At Johns Hopkins

http://www.darkreading.com/insiderthreat/security/privacy/showArticle.jhtml?articleID=217400831

By Tim Wilson
DarkReading
May 13, 2009

An employee at Johns Hopkins Hospital may have leaked the personal 
information of more than 10,000 patients in an identity fraud scam.

According to a report filed to the administrator of the state of 
Maryland's Identity Theft Program [1] (PDF), some 31 individuals with 
connections to Johns Hopkins have reported identity thefts since Jan.
20. Law enforcement agencies suspect the thefts might be part of a 
fraudulent driver's license scheme discovered in neighboring 
Virginia.

In researching the thefts, members of the Johns Hopkins security 
department discovered that a single employee who worked in patient 
registration may have used her access privileges to review data on more 
than 10,000 patients while working at the hospital. The now-former 
employee is expected to be indicted for stealing the data, the report 
states.

The hospital emphasizes that the breach was not a hacking incident, but 
that the employee had access to the records as part of her job.

Johns Hopkins is offering credit monitoring and fraud resolution 
services, as well as $30,000 in identity theft reimbursements, to the 31 
victims, as well as to any of the 526 Virginia residents in the database 
who report fraud. It also is notifying the other 10,000 patients whose 
records were in the database.

[1] http://www.oag.state.md.us/idtheft/Breach%20Notices/ITU-168293.pdf

[...]


--
LayerOne 2009, Information Security for the discerning professional. 
May 23-24 2009 @ The Anaheim Marriott in Anaheim, California 
Visit http://layerone.info for more information