PRIVATE JULIAN PATIENT DATA BREACHED AMID 11-DAY HARD DRIVE LOSS, FIRE OFFICIALS FEAR

Printer-friendly versionPrinter-friendly version Share this

 

Update December 26, 2018 -- Patient data was not on the missing hard drive, long-time Julian-Cuyamaca Fire Protection District Chief Mike Van Bibber has informed EMC. Patients' information was on a county server instead.

By Ken Stone

Reprinted with permission by Times of San Diego, a member of the San Diego Online News Association

Photo:  photo taken Tuesday after backup hard drive was discovered missing. Photo via Brian Kramer

December 12, 2018 (Julian) - Julian fire district officials and local authorities are looking into the possible theft of private medical information and employee records from a backup hard drive.

According to Julian-Cuyamaca fire board member Brian Kramer, the external hard drive with possibly years of data went missing Dec. 1 from a locked room at the Julian fire station on state Route 79.

Wednesday morning, the Bible-sized WD hard drive was found “in the office,” according to county spokeswoman Alex Bell, adding: “There was no theft.”

But Kramer and others are concerned that patient data may have been copied from the drive. Also worrying: Content may have been deleted from the department’s main computer server.

On Tuesday afternoon, following the first meeting of the newly elected Julian fire board, a volunteer IT expert named Greg Hidley noticed that the backup drive was gone, Kramer said.

“He hadn’t been in there for a couple months,” Kramer said he was told. “The cables were still hanging there, but the drive was taken.”

Hidley, who works at UC San Diego and also manages the backcountry fire-detection webcams, found that the last backup was Dec. 1, Kramer said.

“It’s hooked up to the server system,” Kramer said in a phone interview. “Greg had it set up to back up every night at 7 p.m.”

Hidley himself declined comment, saying the matter was being probed by the Sheriff’s Department, and “I don’t want to do anything to jeopardize their investigation.”

Lt. Karen Stubkjaer, a sheriff’s spokeswoman, said Kramer called authorities just after 2 p.m. Tuesday regarding missing property at 3407 state Route 79 in Julian.

“Deputies responded and conducted a preliminary investigation,” she said. “The investigation is ongoing and that is all the information we have at this time.”

Kramer said only four people had keys to the fire station IT room — Julian Fire Chief Jeremi Roesler, fire district secretary Marcia “Missy” Spahr, Julian Battalion Chief James Stowers and Hidley.

“Supposedly, Missy Spahr is calling our legal department to find out what she’s supposed to do,” Kramer said, citing federal HIPAA laws on patient privacy. “There’s a time frame for contacting all the people whose information was lost or breached.”

Spahr didn’t immediately respond to a request for comment, and Roesler directed questions to the county. But a Julian source told Times of San Diego that Spahr contends she found the missing drive in the locked room Wednesday — saying it fell behind the desk into a box in the crowded 6-by-6-foot room.

Kramer scoffs at that scenario.

“There’s no way in hell that it happened the way she said it did,” he said. “Yeah, there was theft. It was not there where it was supposed to be. Somebody moved it. They got caught. … I have no doubt about it.”

Photos taken Tuesday by Kramer show there wasn’t room for the backup drive to fall behind the desk, and even if it had fallen, “its cables would have still been attached (at least the data cable is pretty tight),” said a source who declined to be named.

Before the missing drive was found, San Diego LAFCO chief Keene Simonds said his staff became aware of the hard drive issue Wednesday morning, “and we proceeded to reach out to JCFPD.”

Photo, right:  photo taken Tuesday after backup hard drive was discovered missing shows cables intended for external drive. Photo via Brian Kramer

“The unknown whereabouts of the external hard drive is disconcerting to LAFCO and merits a careful review by JCFPD with respect to (a) finding the device and immediately (b) implementing measures to prevent similar situations from occurring in the future,” Simonds said via email.

Kramer accused the county of engaging in “damage control” and asked: “Who had access to it the last 11 days? Who was in there? … No matter what, it was lost. … It just stinks to high heaven.”

Recently elected Mike Menghini, the new fire board president, said all he knew was what Kramer had told him.

“A little overwhelmed” by Julian district issues, the Menghini Winery owner and former Chamber of Commerce president said he was most focused on a March 19 districtwide vote on whether to dissolve the Julian-Cuyamaca Fire Protection District and hand fire services over to Cal Fire via the County Fire Authority.

In fact, Menghini said a board meeting Thursday night would be held to vote on rescinding the previous board’s request to end the last volunteer fire department in the county.

Officials with LAFCO, the agency overseeing the vote, have said a March 19 vote on dissolution can’t be stopped.

“You know what? We’re going to do it anyway,” Menghini said of the board vote. “Can’t say no unless you ask.”

He said the board would “work our little tails off to convince the public” to reject dissolution.

“It’s a good thing to have two firefighting entities in town at the same time,” he said. “People just don’t realize that they think it’s one or the other — if they vote for the volunteers that Cal Fire is going away. That’s totally wrong.”

Menghini said he spoke with a couple Cal Fire firefighters Tuesday, who told him: “Why isn’t it like it used to be? The last 30 years, we helped them, and they helped us.”

“That’s my argument completely,” Menghini said.