To People Who Have Contacted Me

RE: Stolen Records Class Action

Fellow Concerned University Patrons,

I appreciate the opportunity you have given me to represent you in a class action.  I apologize that I have not been able to speak to each of you individually and I am using this letter to let you know what steps my office is taking in this matter.

As you may have heard, the computer data (“tapes”) have been recovered and reportedly are not “likely” to have been compromised. Here is a link to the Sheriff's news conference announcing the recovery.  Nevertheless, the data was exposed for about a month and, as we all know, it takes no great intelligence to figure out how to retrieve unencrypted computer data, no matter what form of storage medium is used.  Moreover, we know that the University and the Sheriff cannot, at this point, assure that the data was not copied and sold, even if the tapes appear intact.  We also know that the data was at least partially unprotected by encryption, which seems to me to be inexcusable.  Finally, we know that the University itself had no idea what was on the stolen tapes, inasmuch as the initial story was that a few thousand names were involved, then more than 2 million and now allegedly a little more than 1 million.  To me, this speaks of shoddy data management practices on the part of the University, regardless of the culpability of the storage company.

Therefore, let me tell you my thoughts on this matter and tentatively how I am going to approach it.

First, we will maintain a list of the contact information for all who have called wanting to be represented in the proposed class action suit (Filed Complaint is here) and will update you as events progress.  I share your frustration, your concern and even your anger that such sensitive information was handled in such a slipshod manner.  The University and the storage company need to be held to account.

As we have become a more and more complex society, it seems that institutions and big-money players have been made less and less accountable, have been let “off the hook” too often.  Nowhere is this more true than in healthcare, where doctors and hospitals seem bent on operating opaquely with arrogant disdain for the injuries done to individuals. I would like to have your help in addressing this lack of accountability in at least one small way.

As you know, I have filed a lawsuit against Perpetual Storage, the storage company, seeking class action status and asking for long-term monitoring of information that may have been compromised.  My office is continuing an active investigation of how the tapes came to be so poorly handled and I will post this information as it is received.  The police report of the theft is here.

I have also filed a Notice of Claim against University Hospital, as well as taking the steps necessary to start a lawsuit against a healthcare provider.  The Notice of Claim is here.  Unfortunately, owing to a Utah law that requires a certain hoop-jumping procedure before a lawsuit can be filed against a medical provider, it may be as long as six months before University Hospital can be named in the class action suit.  During those six months, my ability to obtain information on what happened at the University is severely limited.  Perhaps the University will see fit to make a very transparent disclosure of what happened and why and how it is being corrected---but I doubt it.  Meantime, we wait for information.

In the interim, I will post everything I can on this website.

I would appreciate receiving from you the answers requested on the information form, which can be found here.  When the form is filled out, you will be asked to verify your identify and that you want me to represent you in a class action as it progresses.

Thank you very much for contacting my office.  I hope that together we will get some straight answers.  Feel free to contact me.  I will do my best to be in touch with you regularly as this matter progresses.

Sincerely,

Clark Newhall