Health agency advises some patients to be extra vigilant over next 12-24 months

Virginia Health Professions officials said they don't have any evidence that personal information was stolen by hackers who accessed a Web site that collects data on some patient prescriptions.

Nonetheless, the department is advising patients and providers who may have data in Prescription Monitoring Program files to be extra vigilant over the next 12 to 24 months in reviewing their financial statements and credit reports.

The department released a statement and a list of questions and answers today about the possible security breach. The matter is being investigated by the Virginia State Police and the FBI.

"We are not making any additional statements," said FBI Richmond office spokesman M.A. Myers. "It's still kind of in its infancy."

Gov. Timothy M. Kaine told The Associated Press today, "This is a crime, and it is being treated that way."

The monitoring program maintains records of prescriptions for narcotics and other controlled drugs that have potential to be abused. The program was created several years ago when Southwest Virginia was dealing with a rash of cases related to people stealing or overdosing on drugs such as OxyContin.

State officials shut down the department's entire Web site last week after an unauthorized message was posted on the monitoring program site.

A Web site that tracks information breaches posted a letter allegedly from the hacker that asks for $10 million or the data will be sold. The letter also implies the hacker somehow corrupted the backup versions of the state files.

In a statement released today, Sandra Whitley Ryals, director of the Virginia Department of Health Professions, said, "We are satisfied that all data was properly backed up and that these backup files have been secured."

"While [the department] cannot comment directly on an ongoing investigation, we can assure the public that all precautions are being taken for DHP operations to continue safely and securely."

Pharmacies report data when a prescription is filled for schedule II, III and IV drugs. Examples include: schedule II-- Ritalin and methadone; schedule III -- hydrocodone and Tylenol with codeine; schedule IV -- Valium and Ambien.

Each time a covered drug is dispensed, the following data is collected:

• Recipient's name and address

• Recipient's date of birth

• Covered substance dispensed

• Quantity of the covered substance dispensed

• Date of dispensing

• Prescriber's identifier number

• Dispenser's identifier number

• Prescription number

Optional data elements include a customer identification number, which could be a Social Security number.

Contact Tammie Smith at (804) 649-6572 or .