Governor Furious After State Publishes Doctors' Private Information Online

December 8, 2006

VERMONT -- At least several hundred, likely more, Social Security numbers of health care providers were posted to the Internet in a state contractor's mistake.

Human Resources Commissioner Linda McIntire said the names and Social Security numbers of doctors, psychologists and others were posted on a Web site requesting bids from contractors.

McIntire wrote a stinging letter to the Segal Group, a New York-based consulting firm the state had used to help it put the health management contract out to bid. She said in an interview with WCAX-TV that Gov. Jim Douglas "is furious, and that's an understatement."

"We can hardly begin to express our disappointment that you allowed this to happen," McIntire wrote to the Segal Group. "We contracted with Segal and have used your services, at considerable expense, in order to have expert assistance from professionals who consistently deal with the challenges of seeking and evaluating bids from health care administrators. We did not expect to encounter this kind of problem as a result of your work."

The state was nearing the end of a two-year contract with Segal with a price cap of $681,000.

Commissioner Thomas Murray of the state Department of Information and Innovation  said, "We've taken all the appropriate steps to clean it up in all the places where it might have lived," adding that "we're pretty confident" the effort had been successful.

McIntire said the information was posted on the Web site on which the state calls for bids on contracts from May 12 and was taken down June 19. But she said a doctor, whom she would not identify, told the state that her Social Security number was still online.

Google, Yahoo, and many smaller search engines "cache" Web pages, which allow the viewer to see what the page looked like at some time in the past.

Assistant Attorney General Julie Brill said she had been told state officials had "confirmed with Google that the cached pages are no longer available."

Robert Snapp, an associate professor of computer science at the University of Vermont, said it's impossible to be completely sure that something once posted to the Internet isn't still available in cyberspace despite efforts to remove it.

"It's just a message that you have to be very careful what you put on the Web in the first place," Snapp said.

Paul Harrington, executive director of the Vermont Medical Society, said"Obviously with the frequency of identity theft, to have physicians' and other health care providers' Social Security numbers on the Internet through a state of Vermont web site is an unfortunate mistake".

Brill said those affected should get a credit score and closely monitor credit card and checking accounts to be sure they have not become victims of fraud. In addition, the Vermont Attorney Genera's Web site has a link for people who believe they may have been victims of identity theft.

LifeLock protects your identity even when your Social Security number is compromised.

Are You Eligible for Economic Recovery Money?