Wake Radiology has suspended its relationship with the UNC Chapel Hill medical school study whose computer server was recently hacked, exposing personal data including social security numbers of more than 100,000 patients.
The practice will only participate again if all data is anonymous and unidentified, a spokeswoman said today. (Read a statement from the practice at the bottom of this blog post)
In July, UNC-CH med school officials discovered that a hacker had infiltrated a computer server housing the personal data of about 160,000 patients, including 114,000 social security numbers.
That data should have been secure but was not, officials say. It was sent to the university over time by the dozens of radiology practices who contribute to the Carolina Mammography Registry, a 14-year-old med school study that collects and analyzes mammogram information.
The security breach has caught the eye of the N.C. Attorney General's office and has sparked fears among many women whose personal information was exposed.
I called Wake Radiology this week to get some information and received the following statement.
Wake Radiology, along with 35 other North Carolina-based radiology groups, was a participant in the UNC/NIH study known as the Carolina Mammography Registry (CMR). This study has been collecting information from radiology groups for the last 12 years without any known incidents. We recently learned that a file containing sensitive patient data was stored unencrypted on a UNC server, which had been hacked over two years ago. This, according to UNC officials, resulted in the exposure of personal patient data.
Wake Radiology is extremely concerned about this occurrence. We value the trust that patients have in our practice and will work to ensure that all patients’ questions are answered to the best of our ability. Wake Radiology sincerely regrets any anxiety or inconvenience to patients involved in this unfortunate situation.
Wake Radiology agreed to contribute to this study with the hope and expectation that the pooled data would demonstrate patterns that could lead to earlier and better detection of breast cancers and improved treatments, thus improving public health. As a practice, we are dedicated to researching, learning, and developing new methods that will result in saving lives, so it is particularly disappointing when an effort as promising as the CMR study is compromised.
Since we are very careful and respectful of patient confidentiality, we spent a tremendous amount of time, energy and resources to ensure the quality and security aspects of the data which was transferred from our system to UNC’s system. We thoroughly investigated UNC’s security arrangements and protocols, and felt confident in the procedures outlined in the study.
Every file sent to CMR from Wake Radiology was encrypted and password protected to protect patient privacy. Wake Radiology, along with the other participating practices, is awaiting information on the investigation that is being conducted by UNC officials.
Based on this experience and in the best interest of patient privacy, Wake Radiology has determined that is will no longer participate in studies that require personal patient information. Involvement in future studies will be limited to anonymous, unidentified data.
