USB drive with patient info missing from IU Health hospital

Officials with Indiana University Health Arnett in Lafayette say a USB flash drive containing information from more than 29,000 patients is missing.

The hospital said the unencrypted drive disappeared Nov. 20 from its emergency department. Norma Gilbert, the hospital's director of quality and clinical excellence, said the hospital system hadn't received any patient reports of fraudulent activity as of Tuesday.

The drive had spreadsheets with information of emergency department patients dating to November 2014, including patient names, birth dates, diagnoses and medical record numbers. Gilbert said the spreadsheets did not contain Social Security numbers, credit card or other financial information.

"Patient medical record information is kept on a secure server," Gilbert said. "This is not the standard method of storing patient data. Officials cannot be certain an incident will never occur; however, they are taking steps to minimize the chance of such an incident occurring in the future."

Rhonda Jones, who works in public relations at the hospital, said steps are being taken to enhance protection of portable storage devices.

Gilbert said an investigation to find the device continues. She said hospital officials have no reason to think the information has been used or accessed improperly because the device was in a non-public area.

IU Health Arnett began notifying patients of the missing data last week and has since contacted 29,324 patients. The hospital also set up a call center for questions.

Please enable JavaScript to view this content.

Story Continues Below

Editor's note: You can comment on IBJ stories by signing in to your IBJ account. If you have not registered, please sign up for a free account now. Please note our updated comment policy that will govern how comments are moderated.