With recovery Monday of data tapes containing personal information on 1.5 million people who were treated at University of Utah Hospitals and Clinics over the past 16 years, officials said Wednesday they doubt the information was compromised, but they can't be certain.
During a press conference Wednesday, Salt Lake County Sheriff Jim Winder said his detectives believe three people were involved, although they're investigating whether there might be others.
Shadd Hartman, 37, of Erda, was arrested and booked into the Salt Lake County Jail for investigation of possession of stolen property and unlawful possession of another's ID or documents, both third-degree felonies. He also had two unrelated warrants.
A couple of hours after the press conference, it was announced that a second person, Thomas Howard Anderson, 52, of Salt Lake City, was also arrested and booked into jail for investigation of possession of stolen property and unlawful possession of another's ID or documents.
Police believe Hartman and Anderson were in possession of the tapes for most of the time they were missing, but police do not believe either man originally stole the tapes.
A third suspect was already in custody at an undisclosed facility on unrelated charges when the tapes were recovered.
When interviewed by detectives, Anderson admitted he had the tapes locked in a cabinet in his garage, according to Salt Lake County Jail documents. He also reportedly provided the sheriff's office with the name of another person who also had possessed the tapes.
It was unknown Wednesday if that other person was one of the suspects already identified by the sheriff's office.
The set of eight data tapes contained billing records and, in some cases, Social Security numbers and medical procedure codes. The data are routinely backed up and taken by courier to a secure vault in Little Cottonwood Canyon. But on June 1, instead of taking the gray metal box containing the data directly to the vault, the Perpetual Storage courier left it in his car overnight in a Kearns cul de sac and the box was stolen. The courier was cleared by investigators but lost his job.
Winder described the three suspects as "individuals with substantial criminal histories." He said it was a crime of opportunity, as officials had suspected, but "they knew relatively early on" what they had.
He rated the likelihood the information had been accessed, which would require "a rather sophisticated tape drive system," at two on a scale of 10.
"It's highly unlikely. ... They are definitely not techies. I don't know if they could find their rear end with both hands."
The $1,000 reward offered by the U. for recovery of the data was pivotal, Winder said, and one person will likely get the reward.
Media announcements of the reward and street work by detectives got the attention of those believed responsible for the theft, he said, and "got their jaws a waggin'," which led to the recovery. The case was broken, he said, "with enough pressure and an incentive."
Investigators believe that one individual broke into the car and the others participated post-crime. They may face different charges. Hartman was not believed to be the person who actually burglarized the car, said Capt. Teri Sommers of the Kearns/Magna Precinct, which recovered the tapes.
Monday night, sheriff's dispatchers received a call that broke the case. Sommers was alerted, and within a couple of hours detectives from her precinct met with an unnamed individual on a roadside or parking lot near 300 West and 1100 South in Salt Lake City, where the tapes were handed over.
"Based on the fact that they were returned in the original box in the original condition, there's no indication the information on the tapes has been accessed or misused," said David Entwistle, CEO of University of Utah Hospitals and Clinics. "The tapes are now in the hands of the FBI for forensic analysis."
There's no indication the suspects were shopping for someone who could tap into the information, described as having "some level of encryption," Winder said. And they have found no evidence that the suspects had the technology to get at the data themselves.
"A key point of the investigation is to get these guys to tell us straight up" what they did with the tapes while they had them for three weeks, he said.
Winder praised the U. for its efforts to see that patient interests were protected. Entwistle said they notified the patients by mail of the theft and offered the nearly million people whose records contained Social Security numbers free credit monitoring for a year, an offer that stands. He said that many of the records contain Social Security numbers because that's the identifier used by Medicare and Medicaid. It's also required of anyone seeking financial assistance. But it's otherwise just one form of identification the U. accepts from patients.
Winder said criticism the U. received for the reward's size was unwarranted. His office recommended that amount. To overvalue the data, he added, would be to make it "a Willie Wonka gold bar."
Winder said that besides those whose data potentially made them vulnerable to identity theft, there were three other serious victims to the crime: the U., Perpetual Storage and the courier, who "made a mistake and was victimized as well. On a personal level, he probably suffered more than anyone else."
The three "ne'er do wells" preyed on all of them, Winder said.
A check of court records shows Hartman has a criminal history in Utah dating back to at least 1992, including arrests for driving under the influence and drug possession. Anderson's court record included a handful of minor misdemeanors and infractions, according to court records.
Anderson and Hartman lived together for a time, police said. In recent days, family members had been in contact with Hartman who, they said, knew police were looking for him.
Police spotted Hartman on the street Tuesday and arrested him. Anderson was picked up at an undisclosed residence, police said.The investigation, which involved the Salt Lake County Sheriff's Office, the FBI and the U.S. Postal Service, is continuing.