20,000 records posted after breach at Stanford hospital

Gary Migdol, a spokesman for Stanford Hospital and Clinics, said the spreadsheet first appeared on the site Sept. 9, 2010, as an attachment to a question about how to convert the data into a bar graph.

Dr. Kevin Tabb, the former chief medical officer of Stanford Hospitals and Clinics, will take over as the new CEO of Beth Deaconess Medical Center in Boston next month.

Even as government regulators strengthen oversight by requiring public reporting of breaches and imposing heavy fines, experts on medical security said the Stanford incident spotlights the persistent vulnerability posed by legions of outside contractors who gain access to private data.

The spreadsheet contained names, diagnosis codes, account numbers, admission and discharge dates, and billing charges for patients seen at Stanford Hospital’s emergency room during a six-month period in 2009, Migdol said. It did not include Social Security numbers, birthdates, credit-card accounts, or other information used to perpetrate identity theft, he said, but the hospital is offering free identity protection services to affected patients.

The breach was discovered by a patient and reported to the hospital Aug. 22, according to a letter written four days later to affected patients by Diane Meyer, Stanford Hospital’s chief privacy officer. The hospital took “aggressive steps,’’ and the website removed the post the next day, Meyer wrote. It also notified state and federal agencies, Migdol said.

“It is clearly disturbing when this information gets public,’’ he said. “It is our intent 100 percent of the time to keep this information confidential and private.’’

The incident at Stanford, while egregious in its details, is far from rare. Records compiled by the Department of Health and Human Services reveal that personal medical data for more than 11 million people has been improperly exposed during the past two years aloneSince passage of the federal stimulus package, which included provisions requiring prompt public reporting of breaches, the government has received notice of 306 incidents between September 2009 and June 2011 that affected at least 500 people.