The personal information of 5,700 current and former John Hopkins Hospital patients is at risk because of the theft of a single desktop computer. The computer included the names of patients, their social security numbers, birth dates, and their medical information.
The theft occurred more than a month ago. Hospital officials waited two weeks after the theft before reporting the incident to police. Affected patients were not notified that their personal information was at risk until August 24th, almost one month after the theft.
According to the hospital the theft was not reported to the police and patients were not notified immediately because there was a concern that any publicity would hamper efforts to recover the stolen computer.
There is no question that John Hopkins Hospital mishandled this incident. Their actions demonstrate that their interests we in retrieving the desktop computer without generating negative publicity for themselves. What hospital officials have glossed over here is that once the computer was stolen all of the patient information was at risk. Recovery of the desktop from the thief (or thieves) would not change this fact. The exposure of patient information had already occurred. John Hopkins Hospital had an ethical obligation to immediately notify patients and they failed to do so.
Source: www.wtopnews.com
