The spreadsheet first became available on the site last September as an attachment to a question supposedly posed by a student on Student of Fortune, a website that lets students solicit help with their homework for a fee. The question sought help on how the medical data in the attachment could be presented as a bar graph, according to on Thursday.
Stanford University officials did not respond to multiple requests for comment by Computerworld.
According to the Times, the spreadsheet contained names, diagnosis codes, account numbers as well as admission and discharge dates for about 20,000 patients who visited the Emergency Room at the hospital in 2009. No Social numbers, addresses, birthdates, or credit card details were compromised in the breach. Even so, Stanford has agreed to pay for identity theft monitoring services for the victims.
The hospital learned about the spreadsheet this August when a patient noticed it on the Student of Fortune website and informed the hospital about it. The spreadsheet was taken down immediately once the site learned about it.
Stanford has since suspended its relationship with the billing contractor and has asked it to either destroy or securely return all Stanford patient-related data it currently has in its possession, the Times quoted a hospital spokesman as saying.
The Times reported that the spreadsheet had been prepared by the contractor as part of a billing analysis for the hospital.
Student of Fortune did not immediately respond to a request for comment on the incident. But a spokeswoman for Student of Fortune is quoted in the Times article as saying that the site had been unaware of the data until being informed about it by the hospital at which time it promptly took the information down. The spokeswoman said the identity of the poster cannot be determined.
This is the second time in less than two years that Stanford is in the news over a data breach. In January 2010, an employee stole a computer containing protected health information on 532 patients from the hospital's heart center.
The breach resulted in the hospital getting by the California Department of Public Health for its alleged failure to notify affected victims of the breach soon enough as required under state laws. Stanford has appealed the fine contending that it acted in a manner consistent with the state's data breach reporting requirements.
The breach shows yet again how ineffective HIPAA has been in getting organizations that handle healthcare data, to take better care of it, said Deborah Peel founder and chairman of the .
Much of the problems stem from the indiscriminate sharing of sensitive personal information among "legions of secondary users", she said. The average hospital has between 200 and 300 outside vendors and partners with access to patient data, Peel said.
"We do not have an effective federal health privacy law. HIPAA was gutted in 2002 when control over who can see and use patient data for all routine uses was eliminated," she said.
The only way to really get a grip on the problem is to allow patients to exert more control over who has access to their data. "Data should be used for a single purpose after the patient gives consent such as consent to use the data to pay a claim or send to a consultant."
"Consent should be obtained for any secondary or new uses of data," she said. All organizations that handle health data, including third parties should be certified to adhere to the highest standards of data security, Peel said.
Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld. Follow Jaikumar on Twitter at or subscribe to . His e-mail address is jvijayan@computerworld.com.