Reader comments
Officials doubt information on U. Hospital tapes was compromised

I don't wish to add to an event that is just a big waste of everyone's time. Probably two questions come to mind: Why weren't the records transmitted electronically or, why weren't they carried from hospital to records storage inside a Wells Fargo (Loomis Fargo) armored car?

Low Life Attorneys trying to take advantage once again, "one Call...

May I suggest two possible answers?
These were back-up tapes, used to restore information that might be lost in electronic transmissions. Therefore, electronic transmission defeats the reason for the tapes in the first place
Next, I believe that the courier was in error for using his own car and not a company vehicle to pick up the tapes. That has been part of the concern from the beginning, and is the reason for one of the class-action suits.

Bob M.: I think they're a hard-copy backup. Not sure what kind of vehicle they're sent, but the storage place is supposed to be kind of Fort Knox, buried deep in granite.

I mean... Not a hard-copy backup... I meant they're stored on a disk or tape because electronic transfer is highly susceptible to interception. Clearly.

I suspect changes like this will occur for the future anyway. We often need something bad to happen to force our hand for such precautions. Human nature at work. This debacle is just one more event to push health care costs up. Sad!

This should be a wake up call to the IT industry. Isn't it time to encrypt your off-site backup information on tape? Sure it's a little work but the payoff is immediate by securing your data.

@Bob M.

I'm just speculating, but hey, no one does that here, do they? :)

The reason they weren't electronically transmitted was because the point of this transfer was an attempt to save/preserve the original physical media. That's what a company like Perpetual Storage is "supposed" to do - keep original records safe.

And as for why not in an armored car? Likely this was not the first time the U Hospital has used Perpetual Storage for records transfer and storage. Also it's likely that IF the Perpetual Storage employees follow the procedures that they're supposed to, this wouldn't happen. Your question implies that the U knew this employee would be taking the records home with him and leaving them out in his car on the street. I doubt anyone anticipated that.

In essence, it boils down to hindsight. Even if they sent it in an armored car, what if, for example, the driver of the car steals the cargo? Your can analyze things to death after they happen.

I just don't see blaming/suing the U for this. They took prudent steps in good faith. And yes, i'm one of those affected.

Perpetual Storage, on the other hand...

It was encrypted.

My son was a patient and his records were taken. Now I have to spend time that I don't have monitoring a three year old's credit so that we don't end up losing our home. Though I do not agree with class action suits that only benefit the attorneys involved, someone should have to pay for this. My daughter has been in and out of Primary Childrens her whole life, and to date this has never happened with her. Our experience in and out of this clinic was less than satisfactory, and I believe that the loss of records is a result of their lack of concern and attention to detail. This is not an isolated problem there....someone needs to do some house cleaning and teach the team of nurses, doctors and clerical staff at the clinic that medicine is not business first and care later. They have violated the most severe trust with us... in many, many ways, and this is just the icing on the cake. A much needed wake up call, unfortunately at our expense -- again.

It's a prudent disaster recovery choice to store backup tapes off-site, and larger companies often rely on courier services to handle the rotation, transportation, and storage of the tapes. The U should have had sufficient checks in place to make sure the courier service was adequately performing its job and the courier service should have been true to the contract it signed with the U. In my opinion, as an IT director who is constantly concerned with data integrity and security, both institutions are at fault in this case. The U should have known if there was a chance for something like this to happen and the courier service should have had immediate alarms in place to catch the fact that the tapes were not collected at the storage location on time. Companies need, desperately, to care for the critical customer data they're entrusted with!

You can not blame the doctors and nurses for this. In no way does it show their lack of concern. They are not the ones that violated policy and left the records in their car. My records were in there along with my SSN. I am not blaming the hospital for this happening. Take advantage of the hospitals offer of free credit monitoring for a year...that will save you some time. If anyone is to blame for this happening it is the courier and not the hospital or its staff.

Do we really understand the nature of this problem? Do you know what happens to a person when his/her identity is stolen? If you don't, I would encourage you to research the issue of identity theft.

This is a very serious problem for those whose records were recorded on the tapes.

You sound like a very bitter person, and I'm so sorry for whatever happened to your little boy that you have such hostile feelings for PCMC and it's doctors, murses, and staff. My 3 week old grandson just spent a week there with a horrible infection and I've never seen such detailed care as he received. I have also been a patient at the U and would be one of those affected, but I'm not too worried about it, especially now that the information has been recovered.

Take your bitterness and join the class action law suit like the other two losers. Grounds -- "something might happen and I want my money before it does, and of course nothing may ever happen, but who cares, I can get back at the medical profession for whatever they did to my son".

Good luck in your search for a new medical team to take care of your son, and it may surprise you, but doctors, nurses, and even clerical staff do get paid for their knowledge. So I guess you could call it their "business" and yes their business is caring for us who don't know how to care for ourselves.

Here in the US it seems we always need to find someone to blame. But I say this isn't necessarily so. For example, in this case the U. has a contract with a courier service to collect backups. Why the courier? Because the U. doesn't have the resources or skillset for this. You wouldn't want a tech geek throwing the tapes in the back of his car would you? So you get a contract with a company whose business it is to provide this service. From what I've heard they do a good job. But one employee got lazy and didn't do his job and two companies get the blame. People say that they should have made sure. Well, I'm sure they thought they had procedures in place. I'm sure that they're now being modified. But blame? Two things I can think of: encrypt the backups and have two people pick up & deliver the tapes (at additional expense to you and I in the end, naturally).

To John: the tapes are encrypted. You would need a really hightech computer program to decode this. One only found at the U I'm sure.

I am in no way blaming the U Hospital for this mistake. I am also glad that the tapes were found so that my hubby quits getting distressing calls. And Yes both of our information were on those tapes along with our children's.

And to those wondering why such a low reward payment: if the U offered more $ don't you think more of these kinds of thefts would happen, just for the reward $? Or even to announce to these criminals that what they took was Really valuable and they would be less likely to return them unharmed/unused and they would try their hardest to find out what exactly they took? Just a thought or two.

To person talking about Primary Childrens: The University hospital is owned by the State of Utah, Primary Childrens is owen by Intermountain Healthcare (IHC) Primary records are separate from the U's some U doctors have rights to practice at PCMC but they are separate. if your child received a notice of records it was most likely becuase of Medicaid becuase medicaid is ran out of the University!

please let me clarify...I have no hostile feelings for primarys. I love that hospital, it's staff, the billing office, the ER - the lunch ladies - you name it, I love Primarys! We had a miserable experience at the U clinic, and after the sad things that happened to my son there, I will never go back. I am not bitter, just concerned. Please don't read into my letter any hate or malice. I won't be checking the blog again, as it was too upsetting to hear everyone lash out at me. My son was really mistreated there, and since then has had a very difficult time with medical personel. I have no interest in a class action law suit. Thank you for your concern. God Bless.

To 'Anonymous':

Might I ask how you can be sure the records were encrypted? I haven't seen anything in the media reports that stated such. I work in the encryption industry, AND my records were among those lost, so I'm honestly interested, if you have some information that wasn't reported.

even if they were encrypted, aren't all the movies and music cd's being copied encrypted also. My childrens records were taken, and I am very concerned, but to file a suit for something that might happen is like throwing someone in prison because they might kill someone else.