WASHINGTON — A government laptop computer containing sensitive medical information on 2,500 patients enrolled in a National Institutes of Health study was stolen in February, potentially exposing seven years’ worth of clinical trial data, including names, medical diagnoses and details of the patients’ heart scans. The information was not encrypted, in violation of the government’s data-security policy.
NIH officials did not notify the affected patients of the breach until Thursday — almost a month later. They said they hesitated because of concerns that they would provoke undue alarm.
The handling of the incident is reminiscent of a 2006 theft from the home of a Department of Veterans Affairs employee of a laptop with personal information about veterans and active-duty service members. In that case, VA officials waited 19 days before announcing the theft.
“The shocking part here is we now have personally identifiable information — name and age — linked to clinical data,” said Leslie Harris, executive director of the Center for Democracy & Technology. “If somebody does not want to share the fact that they’re in a clinical trial or the fact they’ve got a heart disease, this is very, very serious.”
This month, the Government Accountability Office found that at least 19 of 24 agencies reviewed had experienced at least one breach that could expose people’s personal information to identity theft.
NIH officials said the laptop was taken Feb. 23 from the locked trunk of a car driven by a National Heart, Lung and Blood Institute laboratory chief named Andrew Arai. They called it a random theft.
According to NHLBI spokeswoman Susan Dambrauskas, three government offices that focus on information security were contacted within three days of the theft. But officials did not report it to the NHLBI Institutional Review Board — whose job is to protect the well-being of patients in research — until Feb. 29. The board put it on the agenda for its March 4 meeting, said chairwoman Alison Wichman.
