A theft at the John A. Moran Eye Center at the University of Utah may have caused a disclosure of the information of 607 patients — 602 infants and five adults.
On April 3, the Moran Eye Center discovered a laptop computer and an external storage device were taken from locked storage located at 65 Mario Capecchi Drive in Salt Lake City.
The center says the laptop computer and external storage device “contained limited patient information for 602 infants and five adults who had images taken by Moran specialists…” The affected patients visited the center between the dates of July 1, 2014 and March 30, 2018.
The Moran Eye Center determined the patient information contained on the stolen devices includes partial or full names of patients, birth dates, retinal images and medical record numbers that are used to identify records within the University of Utah Health medical records system.
“Because no Social Security numbers or financial information were stored on either device, we believe the potential for misuse of patient information is low,” said Associate Director of Public Relations and Communications Elizabeth Neff. “To date, we have no indication the information on the stolen devices has been accessed or misused.”
Despite the low risk, the center has recommended a few precautionary measures. Patients should refrain from sharing personal information such as financial details or their Social Security Numbers in calls or emails they have not initiated.
“It’s still sensitive information,” cybersecurity researcher, Neil Wyler, told KUTV, “and combined with data that’s leaked in other breaches if someone were to put all this information together, the profile they could build on someone could be pretty damaging.”
The center recommends patients remain cautious.
By reviewing statements patients have received about their healthcare, they can keep an eye out for insurance fraud. If they see services charged they or their child did not receive, they should contact their healthcare provider or insurance company immediately.
The center is also offering free credit monitoring services to patients.
“As part of University of Utah Health, the John A. Moran Eye Center is fully committed to protecting the privacy of our patients,” Randall J. Olson, CEO of the John A. Moran Eye Center, said in a statement. “I sincerely regret that personal information about any of our patients is ever exposed and especially so for children. While no financial information was disclosed, I understand the concerns that impacted patients and parents may have. For peace of mind, we are offering free credit monitoring for any child or adult whose data may have been compromised.”
In a press release, the Moran Eye Center says it is “improving its policy and procedures and enhancing security measures to reduce the risk of an event like this from occurring again.”
Affected patients will be notified by letters in the U.S. mail that were sent out on June 1. Patients may call the Moran Eye Center at 1-855-349-6456 Monday through Friday between 7 a.m. and 7 p.m. MDT to discuss any questions.
University of Utah police are investigating the theft but have not yet released any details from their investigation.