UF notifying Jacksonville-area patients whose data was breached

A computer containing the private health information of 1,900 patients of a University of Florida physician was managed and disposed of in a way that left the information vulnerable to misuse, according to UF privacy officials here.

Although the computer has been recovered and the risk of anyone using the information for unlawful or mischievous purposes is extremely low, officials said, the university has sent a letter notifying all of the physician’s patients whose information might have been compromised.

Dr. Francis D. Ong, a UF assistant professor of plastic surgery at the College of Medicine-Jacksonville, stored unsecured digital photographs of his patients on the computer as well as identifying information that may have included names, dates of birth, Social Security or Medicare numbers, and other private data, including some individual patient medical information. The patients involved were treated by Ong between approximately July 2005, when he joined UF, and December 2007.

Ong reported to university officials April 23 that he gave the computer to a Jacksonville family with whom he is acquainted in late January or early February of this year. On Feb. 24, a member of the family replaced the computer’s operating system, resulting in the permanent loss of most of the patient information.

“Dr. Ong has reported that the family members used the computer for their personal use and have said that neither they nor anyone else viewed any pictures or medical information on the computer,” said David Behinfar, privacy compliance manager at UF’s College of Medicine regional campus in Jacksonville.

The computer was returned to the University of Florida on April 25 and is now in the possession of university officials.

According to UF policy, confidential patient information should only be stored in highly secure university servers, not on individual computer hard drives.

“Dr. Ong’s storage of these pictures and related data on this computer and his subsequent transfer of the computer to a family were in violation of University of Florida policy,” said Behinfar.

The privacy office mailed the patient letters on Monday (May 19). The mailings included a brochure that outlines ways individuals can safeguard their financial information and provides a privacy office hotline number if they have questions. The hotline number is 1-866-876-4472.

“We work hard to earn our patients’ trust and confidence,” said Dr. Robert C. Nuss, dean of UF’s Jacksonville campus. “We deeply regret this event and apologize to our patients who it may have affected. We have taken steps to prevent incidents of this type from occurring in the future and are continuing to educate our physicians and staff on our electronic data storage policies.”