At the University of Minnesota a fertility doctor (Theodore Nagel) recently misplaced a Flash drive.

No big deal, under normal circumstances. Unfortunately, this particular drive contained 8 years worth of private information covering 3100 patients.

While it would be easy to blame the Doctor, and if I was one of the patients affected that’s probably the route I would go down, it is also important to recognize that the root problem is not necessarily an unlucky Doctor but a poorly conceived record keeping system.

Private: Do Not Enter

Portable, physical media should almost never be used to transport truly sensitive data. CDs, DVDs, Flash Drives and the like are great for archival purposes but unless there is an exceptionally good reason for the information to make it into the wild, it’s always better that the brunt of the data remain on a well controlled, central server.

Why?

The risk of loss and duplication are just too high. There is nothing that a Flash Drive could do that would not be more safely arranged by using a secured server. Unfortunately, while the amount of data that we consume is on the rise — our ability to deal with it coherently is remaining stagnant. Many companies and institutions simply do not recognize data loss as a significant risk — which isn’t great when these are the same institutions we entrust our most sensitive data too.

Luckily for everyone involved, the Flash Drive did not contain any financial data, but it is still an embarrassing situation for everyone involved. The question is, how should institutions that traffic in sensitive information protect it?

(Image) (RSS)