IHC (Intermountain Health Care), one of Utah’s largest employers, regularly donates their surplus computers to a local charity. They recently donated a laptop computer which contained (among other things) a Human Resources file containing the names, Social Security numbers, job titles, and evaluation status of 6,242 employees who worked in 2000 for IHC’s Urban Central Region.
The laptop was decommissioned in 2002 (which included a failed attempt to erase sensitive data) and stored for an some time in a closet before being donated to Deseret Industries and purchased by a local man for $20.
The man who purchased the laptop says he did not misuse or distribute the personnel data before he gave it to Bill Gephardt, a reporter for KUTV News in Utah.
In 2003 IHC changed their decommissioning process to ensure more complete data erasures.
Although CEO H. Gary Pehrson assured employees that “no data were compromised” he says the company has arranged to provide free credit monitoring “for anyone who has questions about the appropriate use of their Social Security number.”
Employees we interviewed (with the promise of anonymity) voiced serious concerns regarding the security of their personal information and hinted at the overall lax security within the company.
