A Colorado insurance company contends it is not obligated to cover astronomical costs incurred by the University of Utah in 2008 after car burglars stole medical billings records filed with sensitive personal information on 1.7 million patients.

U. officials want Perpetual Storage to reimburse the university more than $3.3 million. That's how much the school spent notifying patients of the theft and providing credit monitoring to any who asked, according to a suit filed by the firm's insurer, Colorado Casualty Insurance Co., in U.S. District Court.

The insurer insists the claim is not covered by Perpetual's policy and is seeking a judicial ruling to support its position.

"This is not an uncommon thing. Insurance companies don't want to pay claims," said Perpetual's lawyer Steve McMurray. "We will defend this aggressively. We think there is coverage."

The suit does not challenge the merits of the U.'s claims and the insurer has retained counsel to defend Perpetual against them, McMurray said. Meanwhile, the U. continues to do business with Perpetual.

"We would be disappointed if a judge rules in favor of the insurance company. We would probably pursue other legal means," said Chris Nelson, a spokesman for University Hospitals and Clinics. "The hospital has had to bear those costs so we have been aggressive as we can to recoup those costs."

The money was pulled from clinical revenues over two fiscal years, and the loss did not affect taxpayers and the university's academic mission. Still, the expenses meant less was invested in the university's clinical mission, Nelson said.

Perpetual is a Sandy-based company that specializes in long-term storage of business records, using climate-controlled vaults dug into the granite walls of Little Cottonwood Canyon.

In violation of company policies, a Perpetual courier left electronic U. patient records, stored on magnetic tapes and secured in a metal box, in his personal vehicle overnight in June 2008, police reported. Thieves broke into the car, parked outside a Kearns residence, and made off with the box, whose contents covered 16 years worth of hospital and clinic billings. The records were filled with Social Security numbers, dates of birth and procedure codes that tech-savvy criminals could use to steal patients' identities.

The theft was Perpetual's only loss in 40 years of business, McMurray said.

Police arrested the thieves and recovered the tapes a month later, reporting that there was no evidence the records had been compromised or misused.

The heist earned the two culprits jail sentences and restitution limited to the $500 value of the metal box. But the crime was not solved in time to spare the U. the obligation of contacting thousands of patients.

According to the insurer's suit, the U. claims it generated 6,232 in personnel hours responding to "the Incident" and spent $646,149 on printing and mailing costs and another $81,389 on a phone bank to field more than 11,000 calls over two weeks. But the big hit was nearly $2.5 million for credit-monitoring services for those whose Social Security numbers could have been poached.

"Had [Perpetual] followed their own protocols, this would not have happened," Nelson said. "That individual was the weak link. The company has served us well and continues to do so."

After the crime, the university suspended its dealings with Perpetual, stored sensitive materials on campus and sent teams to its vaults to assess their security, Nelson said. Officials decided to resume its relationship with the storage outfit because the its vaults proved safe from thieves and natural disasters.