The records were stored on computer disks and digital tape that a Providence information systems analyst took home to Milwaukie, Oregon, said Detective Wendi Babst, a sheriff's spokeswoman. The thief had broken a window to gain access to the items.

Providence spokesman Gary Walker said about 58,000 records belonged to patients in Washington, many of them located in Thurston county.

Providence officials said it was customary for a manager or supervisor to take copies home as a readily available back-up.

"We apologize to our patients and our commmunity," said Rick Cagen, the Oregon regional chief executive for Providence. "We know that this is going to inconvenience many, and concern many more."

The nonprofit hospital company said the records included only home health patients, some dating back to 1987, and about 1,500 current and former employees of the home health division. The patients were from across Oregon and Washington.

Washington residents who received oxygen or medical equipment from Providence Home Services may be affected, Walker said.

No hospital, clinic or health plan records were among those stolen.

The records, which were not encrypted, contained names, addresses, Social Security information and sensitive health information.

"The magnitude in terms of the number of patients is alarming, but the thieves probably weren't looking for that," said Anita Ramasastry, a law professor at the University of Washington and director of the Shidler Center for Law, Commerce, and Technology.

"People who want to steal data are usually doing so by breaking network security, hacking, or are sometimes insiders that are actually trafficking and trading in data. It doesn't sound like this was the case here," she said.

The FBI is assisting the sheriff department with the investigation, but no arrests have been made.

The Oregon attorney general's office said Wednesday that Providence may have violated state law. An entity that compiles identity information on people must take reasonable measures to ensure against such a breach, said Jan Margosian, a spokeswoman for the office.

The attorney general's office also questioned why it took Providence more than three weeks to notify patients about the theft, which was reported on Dec. 31.

"That's not ideal," spokesman Kevin Neely told The Oregonian.

Providence is mailing letters to all of the patients whose records were stolen, and has set up a toll-free telephone line staffed by employees who can answer questions.

Walker said the company has changed its procedures so that backup tapes are no longer sent home with employees, but he would not specify what new measures have been put in place.

For More Information:

Providence site for affected patients