Anna Emmons, a prosecutor in the District Attorney's Public Integrity Section, said the investigation began after a Houston cancer patient was contacted by a New Jersey-based bank. The call concerned a March 31, 2008 application filed online for $10,000 in credit in the patient's name, although she had never applied for the credit.
Emmons said e-mail and computer details from the application were traced back to Cloud-Equam. UT police determined that on March 29 she had accessed the patient's hospital application for treatment, which contained confidential identity information.
An analysis of computers at the defendant's home revealed that they contained personal information on two other patients. MD Anderson records showed Cloud-Equam had accessed that data from their hospital files in January.
Emmons said this type of alleged identity theft is particularly difficult for consumers to prevent because they are required to reveal their personal information to receive services.
"They weren't careless," she said.
Emmons said it is up to the requesting companies or institutions to ensure security.
Had the bank not called about a minor matter on the credit application, the alleged identity theft may not have been discovered, Emmons said.
M. D. Anderson issued the following statement:
- "M. D. Anderson is currently assisting in the investigation of a former employee who, we have reason to believe, used the personal information of three patients to attempt to open lines of credit. We are actively working with the University of Texas Police Department and the Harris County District Attorney's Office to investigate and resolve this matter.
M. D. Anderson terminated this person's employment and we contacted the three impacted individuals personally to assist them. Because this former employee had access to patient information in the normal course of her job responsibilities, we are also notifying any potentially impacted patients. To help safeguard against harm to their credit, we will offer these patients free credit monitoring for 12 months.
M. D. Anderson takes seriously its responsibility to protect patients' medical and personal privacy, and will continue to work closely with authorities on this matter."