Johns Hopkins loses 135,000 worker, patient records

08.02.2007
Computer backup tapes containing payroll data on 52,000 Johns Hopkins workers and medical information on 83,000 patients were lost last month, but are thought to have been destroyed, the university and hospital announced Wednesday.

Nine backup tapes that were shipped in late December by courier to a Baltimore-area contractor for conversion to microfiche were never returned, Johns Hopkins authorities said in letters and e-mails sent to former patients and current and former employees. On Jan. 18, Johns Hopkins discovered that the tapes had not been returned; Normally, backup tapes and the resulting microfiche are received within two weeks of their reaching the contractor.

"The investigation concluded that the tapes never reached the contractor. Johns Hopkins believes that the courier mistakenly left the box containing the tapes at another stop," the university said in a statement. "The shipping area at that other stop is generally full of boxes which are placed in a dumpster. Johns Hopkins believes it is highly likely that the tapes were thought to be trash, collected, and incinerated."

Eight of the nine tapes contained payroll information on 20,000 former and 32,000 current employees of John Hopkins University; The data on the unencrypted tapes included employee names, Social Security numbers, birth dates and -- in cases where employees were paid by direct deposit -- bank account information.

The ninth backup tape contained the names of 83,000 hospital patients, their parents' names, race, sex, date of birth, and medical record numbers. The patients affected were seen between July 4 and Dec. 18, 2006, John Hopkins said.

"Our best information is that the tapes have been destroyed," William Brody, president of Johns Hopkins University, said in a statement yesterday. "Nevertheless, we are concerned that there was ever even a possibility that the information on them was out of authorized hands. I apologize to all affected employees and patients. We will review our processes and procedures and make any appropriate changes in an effort to ensure that this does not happen again."