Hospital Victim of Contractor’s Breach

St. Luke's Health System in Idaho has notified thousands of employees after a contracted human resources firm lost a server back-up tape holding sensitive non-medical information, the Idaho Statesman newspaper reports.

The tape had information on employees and their dependents at the Boise-based delivery system and at the Idaho Power electric utility. Data on the tape included names, addresses, dates of birth and Social Security numbers, but no health information. The tape must be played on a special drive to access data.

The Mercer human resources firm realized the tape was missing in April but did not notify the hospital until late June, which was disappointing, a hospital spokesperson told the newspaper. The spokesperson was not immediately available for further comment.

Mercer will provide free credit and identity theft protection services to affected employees.

--Joseph Goedert