MediCorp Health System offers fraud protection to patients whose personal information was exposed on its computer system

PDF: Click here to read a related docuent

Date published: 11/18/2008

BY JIM HALL

MediCorp Health System has offered hundreds of patients a free subscription to a credit-monitoring service after their private medical information was exposed online.

MediCorp, the parent company of Mary Washington Hospital, made the offer last week, nearly a month after patient data temporarily became available to the public.

Letters went to 760 people who had used the online registration system, said Mahogany Hart, spokeswoman for MediCorp. Many were maternity patients who had preregistered online for delivery of their babies at the Fredericksburg hospital.

Jina Haikey, MediCorp's privacy officer, told patients in the letter that the company has contracted with ID Experts, a computer security firm, to notify patients of any changes in their credit reports.

The one-year subscription is free to patients. It includes an insurance policy to cover certain losses, and help from a "recovery advocate" if patient data are misused.

Hart declined to say how much the offer will cost MediCorp. The bill will likely be in the thousands of dollars, depending on how many people accept it.

On its Web site, ID Experts sells a credit-watch family plan for $193.95 per year.

Rebecca Dennison, the person who first reported the security breach, said this week that she was surprised it took so long for MediCorp to respond. She received Haikey's letter last week.

"It makes it sound like they just heard about it," she said. "They've known about it for a month."

Dennison and her husband, Gary, live in Spotsylvania County and reported the problem to police on Oct. 11. Rebecca Dennison said she got a call that night from a stranger who said he was on the MediCorp Web site, reading personal information about her.

The man said later that when he went online to preregister his pregnant wife, he could read hundreds of files from other patients.

The man said 803 files were visible. The files appeared to be for people who had used the online registration service between Dec. 27, 2007, and Oct. 11, 2008, he said.

On a Web site set up by MediCorp and ID Experts, MediCorp explained the delay in notifying patients by saying that it took time to figure out what had happened and to decide what to do about it.

Fraud Alert Consumers who believe they may be victims of identify theft can post a free warning with the three major credit-reporting agencies. The fraud alert also lets users know if someone attempts to open a new credit account in their name. Experian, TransUnion and Equifax, the three nationwide consumer reporting agencies, offer the alerts. The U.S. Department of Justice defines identify theft as a crime in which someone "wrongfully obtains and uses another person's personal data in some way that involves fraud or deception, typically for economic gain." --Jim Hall

Read more stories about Fredericksburg
Date published: 11/18/2008