Charles River Medical Associates says it lost a portable hard drive believed to contain personal information and x-ray images of everyone who received a bone density scan at its Framingham radiology lab within the past eight years. That is, 9,387 people.
The practice mailed letters Monday to the patients whose medical records are missing. The hard drive stored names, dates of birth, patient identification numbers and bone density scan images dating back to 2010.
“There are no leads on where the hard drive went,” Brian Parillo, the executive director, said in an interview Monday. “We’ve looked everywhere in the building, spoken to every person who works there, and nobody knows.”
Staff in the Framingham radiology lab, located at 571 Union Ave., noticed the hard drive was missing in late November. The associates is a group of several dozen physicians and other health care providers who practice in 15 locations in nine MetroWest communities, including Hudson, Marlboro, Natick, Holliston and Northboro.
The device, which has no encryption protections, was updated once a month with bone density records in order to back up those records. Employees last remember seeing the hard drive in late October, according to the associates.
Charles River Medical Associates staff members spent several weeks searching for the drive before notifying patients in a letter mailed on Monday. The group was required to report the privacy breach to the U.S. Department of Health and Human Services and to local media.
“We determined a week and a half or so ago that … it was definitely lost,” Parillo said. “It’s hard to speculate on what could have happened to it.”
In the letter and a press release, Charles River Medical Associates warned patients to take precautionary steps “to guard against any potential negative impact from this unfortunate incident,” including monitoring credit reports.
While the missing hard drive contained thousands of X-ray images of people’s spines, it did not have insurance information or Social Security numbers, the Associates' letter stated.
The company will no longer use unencrypted portable storage devices to store medical records, Parillo said, and it’s undertaking a broader review of its security protocols.
“We’re taking all the steps necessary to make sure this doesn’t happen again,” Parillo said. “We’re doing a full audit of our hardware, retraining all the staff on privacy workflows.”
The hard drive only contained information from the bone density radiology lab at the Framingham clinic, Parillo said. The associates have effectively ended its search for the missing device at this point. The police have not been contacted.