Data Breach News

Tape with personal info of Idaho Power, St. Luke's employees is missing

By Katy Moeller
July 20, 2010

St. Luke's Health System has notified several thousand hospital employees in Boise, Wood River and Twin Falls that a computer server back-up tape containing some of their personal information went missing in an office move.
The lost tape also had information on Idaho Power employees and their dependents, company spokeswoman Echo Chadwick said.

St. Luke's spokesman Ken Dey said the tape was in the possession of Mercer, a human resources consulting company that was doing an analysis of St. Luke's employee benefits. Mercer hired a courier firm to move its files from one office to another, and the tape was discovered missing after the move.
Charles Salmans, global director of public relations for Mercer, said the tape was moved in March from Boise to Seattle, where the company has secure storage of backup tapes. The tape did not arrive in April with the rest of the items sent.

Dey said St. Luke's was notified about the loss of the tape in late June.
"It was disappointing that it took them two months to notify us," Dey said. "I know they were trying to locate the tape."
Chadwick, the Idaho Power spokeswoman, said the company is working with Mercer on making sure that employees' information is better protected in the future.

The information on the missing computer tape may include employees' and their dependents' names, addresses, dates of birth and Social Security numbers. It does not contain personal health information, St. Luke's said.
Salmans said the tape had information on workers from several employers. Citing client confidentiality, he declined to release the names of the companies.

Mercer did a thorough search for the tape, Dey said. St. Luke's notified employees about the lost tape in a letter dated last Wednesday.
"Mercer has no reason to believe the information on the tape has been compromised or misused to date," the letter from St. Luke's says. The risk of that in the future is believed to be extreme low.

"The tape has to be played on a special drive," Dey said. "Unless you have that drive, you'd have a hard time accessing it ... We're pretty confident that there's a small likelihood that any information will be used."
Dey said the several thousand employees on the missing computer tape are all full-time employees who receive benefits. They work at hospitals in Boise and Wood River, or the Mountain States Tumor Institute in Twin Falls.

Mercer has hired the risk consulting company Kroll to provide an ID theft service called ID TheftSmart to affected employees. The service includes free access to current credit report, continuous credit monitoring and identity theft consultation and investigation.
"We're happy that Mercer is stepping forward and providing these services," Dey said.

Source: Idaho Statesman