UCSF computer server with research subject information is stolen

A computer file server containing research subject information related to studies on causes and cures for different types of cancer was stolen from a locked UCSF office on March 30, 2007.

The server contained files with names, contact information, and social security numbers for study subjects and potential study subjects. For some individuals, the files also included personal health information. 

A notification process to those involved in this incident is taking place. There is no specific evidence that data on the server was accessed or is being used by any unauthorized person, emphasize UCSF officials.  Notification is taking place as a precautionary measure to alert these individuals to the signs of identity theft and the steps that can be taken to protect personal information. 

Notification letters were sent Monday, April 16, to about 3,000 individuals. Using backup files, UCSF officials are conducting an extensive analysis of the server data to determine as quickly as possible all the names involved in this incident.

Letter notification will continue as more names are identified.  Because of the large number of files on the server and their complex variety of formats, layouts, and data content, the process is extremely complicated, and UCSF officials cannot predict the total number of names at this time.

A telephone hotline (editor’s note: hotline was disconnected as of 05-01-08) has been set-up to respond to inquiries. A website (http://www.ucsf.edu/alert) also has been established to provide advice and information.

The names of all the individuals were compiled through UCSF’s collaboration with a network of health care partners that collects information from large populations of people.  This information is used to learn about the natural course of disease with the goals of learning how to make early diagnosis, to effectively treat, and, most important, to prevent the disease from occurring.  In order to accomplish this, information is collected from people who have been diagnosed with the disease and those who do not have the disease. 

Individuals without the disease serve as study “controls,” and their information helps researchers understand why some people develop a disease and others do not.

The diseases being studied include brain, lung, and breast cancer. The server was used by staff doing data analysis for epidemiological studies on cancer, which focus on the incidence, distribution, and control of the disease within specific populations. Some individuals associated with the studies have these diseases, some do not and were considered “controls,” and some have died.

For example, one study focused on adults with a type of brain cancer known as glioma, building on 15 years of population and clinic-based research to increase understanding of the genetic, demographic, environmental, and developmental factors associated with this cancer.

UCSF is committed to maintaining the privacy of personal information. 

The UCSF Police Department is currently conducting a full investigation of the theft in collaboration with the San Francisco Police Department.