Goodman said that the health care company has also deployed a USB port-monitoring and policy enforcement application from Philadelphia-based Safend Inc.

"We feel we are ahead of our industry in general in recognizing the extreme exposure of ultrasmall, ultracapacity plug-and-play USB devices," Goodman said.

Eric Ouellet, an analyst at Gartner Inc. in Stamford, Connecticut, said that only about 10% of companies have any policies dealing with removable storage devices.

"It's actually a fairly big problem," Ouellet said. "You can put a small database on them. It's just a matter of time before we hear about someone losing data because of this."

He suggests that companies consider flash-drive monitoring software on PCs and laptops, from companies such as Pointsec Mobile Technologies AB, Utimaco Safeware Inc. and Centennial Software Ltd. Such applications can lock out USB drives or require that they have encryption and password protection in order to work.