Aspies For Freedom

Health agency demotes staffer after breach
Computer holding private data stolen
By Bill Scanlon, Rocky Mountain News
May 26, 2005
A state health department worker who took medical records home and left them overnight in a car - which was then stolen - has been demoted.
Colorado's chief medical officer, Dr. Ned Calonge, said the employee violated department rules by taking the laptop computer home for the weekend.
It contained the records of 1,600 children involved in a federal study of autism, a study that parents of those children were made aware of only after the theft became public.
Some parents were outraged over the security breach and the fact that they hadn't been informed that their children were part of a research program.
"We understand the parents' concerns and are taking this seriously," Calonge said.
The car was recovered but the laptop was gone. Calonge doubts the thieves were interested in specific data in the laptop or that the encrypted records have been decoded.
The main problem, he said, was the security breach.
The State Board of Health has decided that autism should be a "reportable disease," putting it in the same category as infectious diseases such as whooping cough, tuberculosis and the flu, Calonge said.
The federal Centers for Disease Control and Prevention wants to find out what causes autism and whether it is truly on the rise, or whether it's just being reported more often. Eighteen states are participating in the study, which asks such questions as age of onset and whether the condition has been confirmed.
Autism usually appears in early childhood and is characterized by poor social interaction, and communication and behavioral problems.
"It fits into the category of diseases where we want to do surveillance activities to understand more about the condition," Calonge said.
It's important to attach a name to the health records to assure there are no duplicates, he said.
Although the autism records included the children's names, the panel that reviewed each case to determine if the condition was in fact autism didn't see the children's names, Calonge noted. Only employees of the Colorado Department of Public Health and Environment had access to the children's names, and they are under orders not to let the information leave state buildings.
The only exception is when a member of the surveillance team is going to an off-site clinic the next morning. Then, he or she has permission to take a laptop home - but only on a weeknight, not for the weekend, as the employee in this case did.
Also, the employee shouldn't have left the laptop in a car unattended, he said.
Calonge said relatively few parents have complained about the breach. That, and the facts that the information likely wasn't decoded and that there's a backup record of the information, makes him hopeful that Colorado can continue its participation.
Nonetheless, the incident spurred CDPHE to upgrade its encryption software and to re-examine its confidentiality procedures, Calonge said.
"We can't do our work if we can't assure confidentiality," he said.
The department "may very well change our policy" and start informing parents when their children are part of a program involving a noninfectious disease, he said.
Health officials say surveillance of infectious diseases is vital and can't wait for parental consent.
If a child gets whooping cough, for example, it's important the child's school is notified and that steps are taken to prevent an outbreak, they said.
Still, balancing privacy rights and public health is always the department's goal, Calonge said.
"We're looking at how we can continue to work at improving the health of the population, while being sensitive to parent concerns about confidentiality," he said.

Study sounds like watching/spying/categorising and dissecting these families.