Used Computers Become Window Into Private Affairs

The last thing that C.J. Prime expected to find when she booted up the used IBM Personal Computer she had purchased at an Internet auction were 2,000 patient records from Smitty’s Supermarkets pharmacy in Tempe, Ariz.

But that is exactly what Prime found last month when she turned on the computer, which she bought for $159 from Onsale Corp., based in Mountain View, Calif.

All of the software that the pharmacy had used for record keeping was still on the computer’s hard disk, including patient names, addresses, social security numbers and a chronological list of all the medicine that they had bought at the pharmacy.

“I was alarmed at seeing the patient records,” said Prime, who is a self-employed computer technician in Pahrump, Nev. “I know a lot of people who would be devastated if they knew this kind of information was floating around.”

Experts in privacy law say Prime stumbled upon a growing problem in the information age, where sensitive personal information is distributed throughout corporate computer networks onto inexpensive personal computers.

“There are no uniform rules,” said Robert Gellman, a privacy consultant in Washington. “People who are handling dynamite realize that it is sensitive and it can go off in their face. The same thing should be true for medical records.”

There are no national regulations about data storage on computers that are later resold. While many companies have policies that call for destroying data before resale, many states have no requirements that they do so. Some states do have medical confidentiality laws that would require that the memory be wiped out, but Arizona does not.

In the digital treasure trove on her new computer, Prime said, were prescriptions for AZT for AIDS patients, Antabuse for alcoholics, as well as numerous antidepressants and psychotropic drugs such as Elavil, Prozac and Tofranil. She also found narcotic prescriptions for Demoral Fiorinal (NU)3, Davon, Darvocet and Valium.

Since her discovery, Prime, who said she once lost a job after an employer learned she suffered from multiple sclerosis, has embarked on a crusade to alert authorities to the privacy issue.

Prime eventually learned that Smitty’s Supermarkets had merged with Smith’s Food and Drug Centers, a Salt Lake City chain, and that as many as 34 PCs that had been leased by pharmacies in the chain had been returned to the leasing company when the old computer system at Smitty’s was replaced.

A skilled computer user, Prime said she immediately recognized that the used PC represented a computer security problem as well.

“I know that I could have connected to their main office,” she said. “I might have been able to change coverage, or put myself in for a prescription or even created a new person and gone in with the proper DEA numbers.”

How the computer ended up being sold to Prime is a bit of a mystery.

She was told by Smitty’s executives that it was returned to a leasing company, IBM Credit Corp., then obtained by NEI Inc., of Hauppage, N.Y., which was the company that sold them through Onsale on the Internet.

However, a spokesman for Smith’s in Salt Lake City, said the company had compared serial numbers with the leasing company and believed that the hard disk for the computer might have disappeared from a company warehouse. She said that Smith’s was preparing a police report and attempting to reclaim the data on the computer.

“We can only speculate that it went through unauthorized channels,” said Marsha Gilford, a spokeswoman for Smith’s. “Obviously this is an incident we’re taking seriously. The confidentiality between pharmacies and patients is very important to us.”