South Shore Hospital in Weymouth, Mass., which reported in July that back-up patient data for approximately, 800,000 individuals went missing, has completed its investigation. In light of the findings, officials said they would no longer send out individual notices, instead publishing them on organizations' websites, and in offices and in state newspapers.
The back-up computer files contained personal, health and financial information for patients, employees, physicians, volunteers, donors, vendors and other business partners associated with South Shore Hospital. Also included among the 800,000 individuals may have been certain patients of Harbor Medical Associates, PC and certain patients and vendors associated with the South Shore Physician Hospital Organization (PHO), some of whom never have been South Shore Hospital patients.
South Shore contracted with Phoenixville, Pa.-based Archive Data Solutions this past Feb. to conduct offsite destruction of the back-up tapes. Archive Data solutions then subcontracted the work without South Shore Hospital's prior knowledge to Graham Magnetics, which arranged for three boxes of the computer tapes to be shipped to its Texas facility for destruction using Ohio-based R+L Carriers to transport the files. After repeated inquiries about certificates of destruction, the hospital was informed in June that Graham Magnetics had received and destroyed the contents of one of the three boxes of computer tapes, but had not received the other two boxes.
The hospital, along with the other involved parties, immediately launched an investigation to find the two missing boxes. The hospital also engaged computer forensic experts from Huron Consulting Group to assess whether information on the missing back-up computer files could be acquired, accessed, used or disclosed in an unauthorized manner that could pose a significant risk of financial, reputational or other harm to an individual. According to its findings all available evidence indicates that the files are unrecoverable and that there is little to no risk that information on the files has been or could be acquired, accessed or misused.
Key investigation findings:
- The back-up computer files were stored on unmarked computer tapes that were packed in three sealed boxes. The boxes were wrapped together on a shipping pallet and had no indication on the outside or inside that they contained confidential information.
- South Shore Hospital, the private investigation team, and R+L Carriers conducted multi-state searches for the two missing boxes. All available evidence indicates that the three boxes of computer tapes were likely separated from each other during transport. Once separated, two of the three boxes were unidentifiable because they were unmarked and appeared to be of no value. As a result, those two boxes of computer tapes are believed to have been disposed of in a secure commercial landfill that R+L Carriers uses to dispose of unclaimed materials and are therefore unrecoverable.
- Even if the computer tapes were found, Huron's experts have concluded that specialized equipment, proprietary software, sophisticated knowledge, time and financial resources would be required to access, aggregate, interpret and ultimately use information on the files.
When South Shore Hospital initially notified the public about this matter its investigation was still underway. At that time, the hospital anticipated sending individual written notices to those whose information may have been on the back-up computer files. In light of the investigation findings, South Shore Hospital, Harbor Medical Associates and South Shore Physician Hospital Organization do not plan to send out individual notices and are instead publishing notices, consistent with Massachusetts General Law Chapter 93H, to inform the community about steps that always are available to protect information. These notices will be published in the state's largest-circulation newspapers, posted to each organization's websites, and exhibited at the hospital and in physician offices.
"The investigation into this matter has been extremely thorough and has involved numerous qualified independent experts. Based on what we've learned, I am confident that there is little to no risk that information on the files has been or could be accessed," said Richard H. Aubut, South Shore Hospital president and chief executive officer. "Nevertheless, I remain deeply sorry about this situation and any concern it may have caused."
