Indiana University iu.edu Indiana University data breach: what happened and what to do
A laptop belonging to an Indiana University medical resident was stolen from a car. It held health information on about 3,266 people, including names, birth dates and Social Security numbers. The breach appears on the HHS breach list from November 2012.
View all 13,177 breaches- Breach date
- 5 Nov 2012
- Made public
- 5 Nov 2012
- Affected
- 3,266
- Data exposed
- Names, Medical record numbers, Dates of birth, Diagnosis codes, Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
According to the U.S. Department of Health and Human Services (HHS), an unencrypted, password-protected laptop was stolen from the car of an Indiana University employee, a medical resident. It held electronic protected health information on approximately 3,266 people. The case appears on the HHS Office for Civil Rights breach list in November 2012.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What was exposed
HHS lists names, medical record numbers, birth dates, diagnosis codes and Social Security numbers. A Social Security number with a name and birth date is what criminals need to open credit in someone's name, so this is the part to act on.
The response
HHS says the university notified HHS, the affected people and the media. It audited the employee's department and equipment, retrained staff, updated its HIPAA policies and encrypted its laptops. HHS's Office for Civil Rights obtained written assurances that these actions were taken.
Why a stolen laptop matters
The laptop was password protected but not encrypted, which is why HHS treats the loss as a breach of everyone's records on it. A password alone doesn't stop someone who removes the drive. Encryption does, and the university encrypted its laptops afterwards. There's no sign in the HHS description that the data was misused, but a stolen Social Security number stays useful for years, so the steps below are worth doing even now.
What to do if you were in it
- 1
Freeze your credit
Because Social Security numbers were involved, the FTC advises a credit freeze. It's free and you place it with each of Equifax, Experian and TransUnion.
- 2
Read your medical statements
Check explanation-of-benefits statements for services you didn't receive. Report anything wrong to your insurer.
- 3
Report identity theft at IdentityTheft.gov
If someone opens an account in your name, the FTC's IdentityTheft.gov builds a recovery plan and reporting steps.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see whether your email address or phone number shows up in known breaches. Serus monitors breach databases and the dark web and alerts you if your data appears, and tells you what to do next. It can't remove data from a breach, so the steps here are what protect you.
Official filings
- U.S. Department of Health and Human Services , filed 5 Nov 2012 : 3,266 people
- U.S. Department of Health and Human Services , filed 4 Oct 2011 : 3,266 people
Timeline
-
Reported to U.S. Department of Health and Human Services
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Indiana University breach?
HHS says about 3,266 people were affected, and the university notified them directly. If you were treated by the resident involved, check for a letter.
What was exposed?
Names, medical record numbers, birth dates, diagnosis codes and Social Security numbers, according to HHS.
Should I change my password?
No passwords were listed as exposed. Focus on your credit and your medical statements.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
