260,000 patients' data mishandled

INDIANAPOLIS -- A hospital system has started notifying at least 260,000 patients of its Indiana and Illinois hospitals that a medical records contractor has lost compact discs containing their Social Security numbers and other personal information.\nOfficials of Sisters of St. Francis Health Services, however, say the lost CDs were recovered and that they do not believe any of the information was improperly accessed.\nA letter to patients of St. Francis, which operates 10 hospitals in Indiana and two in Illinois, said that in July an employee of a medical billing contractor copied the data onto several CDs and placed them in a new computer bag to work on it from home.\nThe employee later decided the bag was too small and exchanged it at a store, accidentally leaving the discs inside, the letter said.\nLisa Decker, a spokeswoman for St. Francis subsidiary Greater Lafayette Health Services, said the person who later bought the bag immediately returned the discs to the company and that officials were confident the data was not accessed.\n"A lot of work has been done trying to compile the data and recreate the records, so we knew who to contact to let them know that this data was temporarily unsecured," Decker said.\nSt. Francis patient Pam Newton said she was worried about how the information was mishandled by the worker.\n"She had no malicious intent, but why would they allow their employee to carry such instant information away from an office?" Newton said. "They have everything they need to obtain my identity."\nThe letter to patients urged them to check their credit reports.\nDecker said the hospital system was examining its procedures for handling patient information and training for hospital employees and contractors.\nSt. Francis operates hospitals in Indianapolis, along with the Indiana cities of Crawfordsville, Crown Point, Dyer, Hammond, Lafayette, Michigan City and Mooresville and the Illinois cities of Chicago Heights and Olympia Fields.