Patients sue Sutter Health over stolen data [Appeal-Democrat, Marysville, Calif.]

Nov. 24--Yuba-Sutter residents are concerned _– and a little angry -- that their personal information may have been compromised in a data theft from Sutter Health.

Patients began receiving letters this week notifying them that an unencrypted computer stolen from a Sacramento health office last month contained patient names, addresses, phone numbers and medical information. Sutter Medical Foundation said it has no reason to believe the computer was stolen for the information it contained but is encouraging patients to review their explanations of benefits and report suspicious activities.

"I felt real violated," said Olivehurst resident Mike Hyatt. "I felt like I was vulnerable, when with all the identify theft I have been trying real hard the last few years not to have that happen."

On the weekend of Oct. 15, someone threw a rock through a window of Sutter Medical Foundation's administrative offices in Sacramento and stole a computer, monitor, keyboards and other equipment, said communications director Karen Garner. The theft was reported to the Sacramento Police Department and spurred an internal investigation.

The computer had data for 3.3 million patients whose providers are supported by Sutter Physician Services, including names, addresses, email addresses, dates of birth, telephone numbers and names of patients' health insurance plans dating from 1995.

The computer had the same information for 943,000 Sutter Medical Foundation patients from January 2005 to January 2011 and descriptions of their medical diagnoses or procedures used for business operations.

Patients were contacted as soon as it was determined who was affected and how, Garner said.

But a month-long delay between the theft and mailing of the letters is particularly frustrating to patients.

Yuba City resident and longtime patient Paul Hillegass learned about the breach in the newspaper, and when he called Sutter Health he was told a letter is headed his way. But the hospital should have notified people immediately that their information may have been compromised, he said.

"They had people's information in the computer. I'm sure it didn't just contain useless information," Hillegass said.

Hillegass, his wife and daughter were all affected, and with his law enforcement background, he said identity theft was his immediate concern. He plans to contact his credit bureaus and financial institutions to place safeguards on his account.

"I'm very aware of what type of information people use and it doesn't take much," he said. "This can affect us up to the next 15 years because this information is bought and sold on the illegal market."

Many Yuba-Sutter residents said they are interested in a class-action lawsuit filed Monday in Sacramento Superior Court.

The lawsuit, filed on behalf of plaintiff Karen Pardieck of Folsom, alleges the Sacramento-based health network was negligent in safeguarding its computers and data and did not notify the patients whose data went missing within the state-required timeline. It seeks $1,000 for each member of the action and attorney's fees.

Marysville resident Angelica Lopez is among those pursuing litigation after learning this week the personal information of her five children, ages 2 to 17, had been breached. It's not just fraud and identity theft that worries her, she said.

"You never know, they could be planning to do home invasions," she said. "Even though they say it wasn't the social security information, that's still important information no one should have."

Sutter Health is not offering credit monitoring services because no financial information, social security numbers or banking details was lost, Garner said.

Sutter Health was in the process of encrypting computers throughout its system when the theft occurred and has accelerated its efforts in light of the security breach, she said. Encryption technology scrambles computer data to make it difficult for unauthorized users to retrieve information.

"We take our responsibility of providing quality care very seriously. That includes protecting our clients personal and medical information," she said. "We regret the theft and any concern or inconvenience this has caused our patients."

Sutter Medical Foundation works with more than 1,300 primary and specialty clinicians in eight counties and has posted a list of impacted facilities online. Because patients travel to receive care, it's not possible to determine how many Yuba and Sutter residents were affected, Garner said.

Longtime patient Jill Corbella received the letter Tuesday to notify her that she, her husband and their four children were among those whose information was taken.

"I was totally blindsided," she said. "I'm kind of frustrated at Sutter and the way they just handed us a letter portraying it nonchalantly."

Patients have a reasonable expectation that their personal information is safe with a health provider, she said, so it's disappointing for such a security breach to occur. She contacted her insurance providers Wednesday to be issued new identification cards and numbers.

"As a patient it really stinks because there is not much we can do," she said. "You are left with 'It is what it is.'"

Sutter Health said on its website that patients who have concerns about the data theft can call toll-free at 855-770-0003, Monday through Friday from 8 a.m. to 5 p.m., and then enter this 10-digit reference code: 7637111511.

Are you a Sutter Health patient who was affected by this data breach? Reporter Ashley Gebb is working on this story today. Email her at agebb@appealdemocrat.com or call her at 530-749-4783 if you have any information on the topic to share.

___

(c)2011 the Appeal-Democrat (Marysville, Calif.)

Visit the Appeal-Democrat (Marysville, Calif.) at www.appeal-democrat.com

Distributed by MCT Information Services