Raleigh clinic says X-rays were stolen, may have included patient information

[Erica Absetz <erica () riskbasedsecurity com>]

http://www.newsobserver.com/2013/05/06/2875900/raleigh-clinic-says-x-rays-were.html

RALEIGH — Patients who had X-rays at Raleigh Orthopaedic Clinic before
2008 are being urged to keep an eye on their bank statements and
credit reports after 17,300 sets of X-rays vanished.

A company the practice hired in January to convert X-ray films to
electronic files never returned the materials, according to a letter
sent to clinic patients. Instead, the X-rays are thought to have been
resold for the value of the silver they contain, said Constance Scott,
the clinic’s security officer.

“We have reported it to the police,” Scott said, declining to name the company.

The identifying information on the X-rays included only patients’ full
names and dates of birth.

“Raleigh Ortho does not believe that any other individually
identifiable information was on the X-rays,” the company said in a
statement. “Nevertheless, Raleigh Ortho has recommended that the
patients remain vigilant by reviewing their account statements and
monitoring their credit reports.”

The practice determined in March that it had been “the victim of a
scam,” the statement says, in which the records were resold to a
company that harvested the silver, then destroyed the film, clinic
officials said. X-rays may contain as much 2 percent of their weight
in silver, which now sells for about $24.50 an ounce.

Raleigh Orthopaedic has five offices and a surgery center in Wake
County. Patients who have questions can contact Scott at 800-358-5735.

Last year, police found X-rays from 38 medical facilities, including
some from North Carolina, in the possession of two South Carolina men
who had posed as recycling company employees, according to the online
medical news site MedCityNews.com.

The N.C. Hospitals Association does not have specific guidelines for
the disposal of X-rays, said spokesman Don Dalton
_______________________________________________
Dataloss-discuss Mailing List (dataloss-discuss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://datalossdb.org/mailing_list

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
Risk Based Security equips organizations with security intelligence, risk
management services and on-demand security solutions to establish
customized risk-based programs to address information security and
compliance challenges. 

Tenable Network Security (http://www.tenable.com/)
Tenable Network Security provides a suite of solutions which unify real-time
vulnerability, event and compliance monitoring into a single, role-based, interface
for administrators, auditors and risk managers to evaluate, communicate and
report needed information for effective decision making and systems management.