National Hospital Organization: a work laptop taken home by an employee of Himeji Medical Center, holding about 140,000 patient records, was put up for sale at an internet auction

1. 2020-10-03

   A person who appeared to have won the laptop at an internet auction contacted the organization, and the problem came to light. [1]

2. 2021-03-19

   The organization disciplined the employee who took the laptop with a ten-day suspension. [1]

3. 2021-04-07

   The organization announced the case. [1]

At the end of 2018, a clerical employee of Himeji Medical Center took a work laptop home without permission to finish work. The center was replacing its terminals, and the laptop was no longer used and scheduled for disposal, so nobody noticed it was gone. [1]

The employee used the laptop at home for a while, then stopped and forgot about it. In September 2020, the employee's family wrongly thought it was unneeded and asked a disposal company to dispose of it, and a person who bought it from that company listed it at an internet auction. The organization bought the laptop back from the winner and checked its logs, finding no sign that the files in question had been opened since the employee last worked on it. [1]

The laptop held about 140,000 records of personal information, unencrypted. About 120,000 of them were a list of stored paper charts, with names and last visit dates. The remaining 20,000 or so were names, birth dates and addresses, and about 4,000 of those also included disease names. [1]