This is an archived article that was published on sltrib.com in 2008, and information in the article may be outdated. It is provided only for personal research purposes and may not be reprinted.
Now that the billing records of 1.5 million University of Utah Hospital patients have been recovered, police and U. officials are downplaying the possibility that the information will ever be used to commit identity fraud.
Three suspects in the June theft are in jail. On Wednesday, Salt Lake County Sheriff Jim Winder characterized them as "random" burglars who likely had neither had the equipment nor know-how to gain access to the tapes' partially encrypted data.
"They're not techies," Winder said at a news conference. "I don't know if they could find their rear end with both hands."
Nevertheless, patients continue to sign on to two potential class-action lawsuits against the U. and the storage company it hired. The tapes were stolen after a courier for Perpetual Storage violated company policy by leaving the tapes in his personal vehicle outside his home in Kearns instead of taking them to the company's vault in Little Cottonwood Canyon.
"I'm still a little bit flustered by the entire thing," said Bob Henline, a current U. patient in Tooele whose Social Security number was included in the tapes. He contacted lawyers to join one of the suits. "It seems to me like simple precautions could have been taken to prevent this travesty."
Winder described the courier, who was fired, as a "victim" and said he is not being charged with a crime.
The courier's car was burglarized in early June, and police theorized the thieves were attracted by a duffle bag that was on top of a container holding the tapes.
Shadd Dean Hartman, 37, was booked into the Salt Lake County jail early Wednesday on suspicion of possession of stolen property and unlawful possession of another's identification, both felonies.
Thomas Howard Anderson, 52, was arrested Wednesday afternoon and booked on charges of theft by receiving, identity fraud and an unrelated warrant. A third suspect, who was not identified, is in custody on unrelated charges.
Winder, who hasn't ruled out further arrests, credits the tapes' recovery to the U.'s $1,000 reward and good detective work. He said at least five detectives worked overtime on the case.
The reward "got [the thieves'] jaws a-wiggling," Winder said. As they fought over who should get the money, another man informed police late Monday night, said Capt. Teri Sommers. Within hours, tapes were turned over to police. That unnamed man may get the reward.
Winder defended the low amount of the award, saying he didn't want the U. to offer a sum that would alert the thieves they had pilfered something akin to "the Willie Wonka golden bar thing."
The VHS-size tapes have been given to the FBI for a forensic analysis to determine if they have been accessed. After inspecting them, U. officials believe the tapes are the originals.
"On a scale of one to 10, it's a two that this data has been compromised," said Winder.
Still, he advised patients to monitor their credit reports. The U. of U. plans to continue its offer of one year of credit monitoring to the 953,000 patients whose Social Security numbers were included in the records.
"There's really no indication the information has been accessed or misused," said David Entwistle, the hospital's CEO. "We understand the great concern . . . to our patients and are very sorry about that."
While the U. has spent $2 million on the credit monitoring and to notify patients, plaintiffs in two lawsuits say it isn't enough. The suits seek credit monitoring for at least five years, fraud protection and money to restore their credit and identities if stolen.
Besides fearing ruined credit, some patients fear being blackmailed to avoid the disclosure of sensitive medical information like HIV-positive status or drug addiction treatment; being issued a warrant for a DUI after their driver license number is misused; or being held responsible for taxes if their personal information is used to get a job.
Attorneys aren't ready to call off their suits against the U. of U. or Perpetual Storage.
"Our primary concern remains the security of the sensitive information contained on the stolen tapes and on correcting the problems that allowed this to happen in the first place," said attorney Karra Porter in a prepared statement.
Added attorney Clark Newhall: "Can the U. provide assurances, can the company provide assurances the tapes were in fact not sold? If you have 1 million Social Security numbers, do you think perhaps somebody in say, Slovakia, might pay $1 per [number]? Gosh, I bet they would."
Entwistle said the suits are without merit and noted that had the Perpetual Storage employee followed protocol, the theft wouldn't have happened.