If related violations of specific agreements are found, the state could sue Medco, Norris said.

Piscitelli said the Medco employee had possession of a laptop computer owned by Medco that contained the prescription benefits membership numbers -- which are the same as employee Social Security numbers -- of the state employees and dependents. Birth dates and details about the drugs the patients were taking were also in the data records. But the data, which is from 2003 and 2004, did not include names or addresses of the affected persons.

The Medco employee was using the data for a routine audit of the prescription benefits records of the patients, Piscitelli said.

"Our concern is that the state can't gamble" with such data losses, he said. "We hope that this was just a theft, that someone was interested in the laptop and not the information on it."

The agency has received no reports of identity theft or credit fraud from any of the persons affected by the incident, Piscitelli said.