ARLINGTON - The University of Texas at Arlington has notified about 27,000 individuals of a potential data compromise involving prescription records maintained by the Student Health Center since 2000.
UT Arlington recently learned that one of its file servers had been compromised, potentially exposing the records of students, faculty and staff who received a prescription or filled a prescription through the Health Center between 2000 and June 21, 2010.
The University is not aware of any fraudulent use of the information.
The information that may have been exposed included names, addresses, prescription names, amounts spent and diagnostic codes. In addition, records for 2,048 of the 27,000 affected individuals included Social Security numbers. None of the records included credit card information or any other medical records.
UT Arlington's Office of Information Technology detected the potential data exposure June 21 on a file server containing Student Health Center prescription records. An extensive review determined that the data had been compromised on four occasions: Feb. 19 and April 28, 2009, and Jan. 23 and Feb. 10, 2010. The affected server was taken offline immediately and secured.
The compromise was limited to a single file server. No other University servers were affected.
UT Arlington has mailed letters to all 21,554 individuals whose information was potentially exposed and for whom it had sufficient contact information. It is using alternate methods to notify the remainder of those individuals whose contact information was out-of-date or incomplete.
Additionally, UT Arlington President James D. Spaniolo issued a message to the University community about the data compromise and the actions the University has taken, under his direction, to address the situation.
The University also has contracted with Equifax to provide free credit monitoring for one year to individuals whose records included Social Security numbers.
The University has notified appropriate authorities and law enforcement officials of the incident and has established a data information call center to answer questions from affected individuals. Anyone who received a prescription or filled a prescription at the Student Health Center between 2000 and June 21, 2010 - and who does not receive a notification letter from UT Arlington by July 28, 2010 - may contact the call center at 800-913-3055 for further information. A website, www.uta.edu/data, contains the latest information related to the incident.
UT Arlington takes privacy issues regarding personal data very seriously and is engaged in a careful review of the University's information technology protocol and other policies and procedures to ensure that the best industry security practices are in use.
The University of Texas at Arlington is an Equal Opportunity and Affirmative Action employer.