News-Letter

Prompted by recent events at Hopkins, the Maryland Senate unanimously passed a bill on March 16 that requires businesses to notify state residents without delay when their personal information has been compromised.

The measures have been backed by consumer advocates who assert the need for better protection against identity theft in light of events in December at Hopkins involving the loss of nine computer backup tapes containing sensitive personal information for 135,000 employees and patients.

The tapes were reportedly misplaced on Dec. 21, 2006. The University discovered that they had not been returned from Anacomp Company, a contractor.

The investigation involving both the University and Hopkins Medicine Security began on Jan. 18.

However, the patients, employees and students whose records were misplaced were not informed of the incident until Feb. 7. The University maintains that the box containing the tapes was most likely collected as garbage and incinerated.

"The University testified in favor of a notification bill," said Dennis O'Shea, executive director of Communications and Public Affairs.

"The University made its notifications in February not because it was required by law -- in most cases it was not -- but because it was the responsible thing to do. We certainly do not feel threatened by the prospect of Maryland's having a notification law, because we quite clearly believe that notification is the proper course under circumstances like the ones that we faced in our case," he added.

The University maintains that it took the correct course of action when faced with the problem of the missing tapes.

"I would argue with [the] implication that there was some sort of unduly long delay in the Johns Hopkins notification. In fact, once the University became aware that the tapes had not been returned from the contractor to which they were sent, it acted quickly to investigate what had happened and to prepare a notification campaign. Both the investigation and the notification were quite complicated. They took time," O'Shea said.

"But a lot of people at Johns Hopkins worked a lot of extra hours to get the matter investigated and to get the word out as quickly as we did," he said.

As for the investigation following the incident to find the whereabouts of the tapes, O'Shea said, "There is no change. We still believe it is very likely that they were inadvertently placed in a dumpster and incinerated."

The bill passed by the State Senate applies only to businesses with annual incomes exceeding $1 million. The bill had failed in the previous Senate sessions prior to the event at Hopkins.

On the same day, the House Economic Matters Committee approved a similar security-breach bill as well, which would allow residents to block access to their credit reports, according to the Baltimore Sun.

Article Tools