Fired U of U researcher exposes breaches in student data | KJZZ
Fired U of U researcher exposes breaches in student data
BY CHRIS JONES & NADIA PFLAUM, KUTV TUESDAY, JANUARY 4TH 2022
Dr. Judith Zimmerman knew she was fired for doing the right thing.
thumb_91107.png
thumb_46995.png
VIEW PHOTO GALLERY
3 photos
share now!
tweet now!
(KUTV) — Dr. Judith Zimmerman knew she was fired for doing the right thing.
She was the lead investigator on a research project on autism in children, which she spearheaded at the Utah Department of Health. She brought that project, and a very sensitive database of data, to the University of Utah, where she was in charge of securing grants, overseeing contracts for data procurement and, most importantly, making sure that data was secure.
When she found out that it wasn’t, though – that in 2012, her superiors and other researchers had gone behind her back to share deeply personal, identifying information about Utah K-12 students, and asked her to sign off on doing so after the fact – she was abruptly fired for raising alarm.
“The data in question involved approximately three fourths of a million highly sensitive children's mental health and educational information,” Zimmerman tells KUTV, “which is by its nature is very valuable to researchers because of how complete it is.” This included, in part, birth dates, full names, behavioral and academic reports from Utah public schools, parents’ demographic information, and medical records.
But when she was terminated, her research and her lucrative grants were yanked out from under her, and the researchers who she blames for mishandling the data carried on with the research as their own. Seeing it as clear retaliation, Zimmerman filed a federal whistleblower complaint.
Zimmerman prevailed on a whistleblower lawsuit in federal court and was awarded some damages and attorney fees, But she still had questions. The federal trial did not address a breach of contract claim and what happened before she was wrongfully terminated – what actually happened to the data, and who allowed the encrypted, supposedly secure database to be accessed without permission.
“My questions were, was the data copied? If so, what data was copied and what authorization did the researchers use to copy that data?” Zimmerman says.
So she filed another lawsuit in state court, in 3rd District, Salt Lake City. But the proceedings also fell short of providing the whole truth.
“In the middle of trial, I believe it was the 3rd day of a 5-day trial, the judge realized that the university had withheld evidence,” Zimmerman says. The judge made a declarative judgement and then a jury decided any damages and awarded Zimmerman $760,000.
It feels like unfinished business to Zimmerman, who is still pursuing answers as to whether the leaky records-keeping she witnessed continues today.
“What hasn't happened is, no one has independently looked at the research misconduct I reported,” Zimmerman says.
The University of Utah provided KUTV 2 News with this statement:
"THE UNIVERSITY OF UTAH HAS ROBUST POLICIES IN PLACE FOR DATA INTEGRITY AND SECURITY AND STAND BY THOSE POLICIES. WE BELIEVE IN OUR RESEARCH, INCLUDING OUR METHODS TO DIAGNOSE, TREAT, AND STUDY AUTISM AND ARE COMMITTED TO CONTINUED RESEARCH IN THIS AREA.”
BY CHRIS JONES & NADIA PFLAUM, KUTV TUESDAY, JANUARY 4TH 2022
Dr. Judith Zimmerman knew she was fired for doing the right thing.
thumb_91107.png
thumb_46995.png
VIEW PHOTO GALLERY
3 photos
share now!
tweet now!
(KUTV) — Dr. Judith Zimmerman knew she was fired for doing the right thing.
She was the lead investigator on a research project on autism in children, which she spearheaded at the Utah Department of Health. She brought that project, and a very sensitive database of data, to the University of Utah, where she was in charge of securing grants, overseeing contracts for data procurement and, most importantly, making sure that data was secure.
When she found out that it wasn’t, though – that in 2012, her superiors and other researchers had gone behind her back to share deeply personal, identifying information about Utah K-12 students, and asked her to sign off on doing so after the fact – she was abruptly fired for raising alarm.
“The data in question involved approximately three fourths of a million highly sensitive children's mental health and educational information,” Zimmerman tells KUTV, “which is by its nature is very valuable to researchers because of how complete it is.” This included, in part, birth dates, full names, behavioral and academic reports from Utah public schools, parents’ demographic information, and medical records.
But when she was terminated, her research and her lucrative grants were yanked out from under her, and the researchers who she blames for mishandling the data carried on with the research as their own. Seeing it as clear retaliation, Zimmerman filed a federal whistleblower complaint.
Zimmerman prevailed on a whistleblower lawsuit in federal court and was awarded some damages and attorney fees, But she still had questions. The federal trial did not address a breach of contract claim and what happened before she was wrongfully terminated – what actually happened to the data, and who allowed the encrypted, supposedly secure database to be accessed without permission.
“My questions were, was the data copied? If so, what data was copied and what authorization did the researchers use to copy that data?” Zimmerman says.
So she filed another lawsuit in state court, in 3rd District, Salt Lake City. But the proceedings also fell short of providing the whole truth.
“In the middle of trial, I believe it was the 3rd day of a 5-day trial, the judge realized that the university had withheld evidence,” Zimmerman says. The judge made a declarative judgement and then a jury decided any damages and awarded Zimmerman $760,000.
It feels like unfinished business to Zimmerman, who is still pursuing answers as to whether the leaky records-keeping she witnessed continues today.
“What hasn't happened is, no one has independently looked at the research misconduct I reported,” Zimmerman says.
The University of Utah provided KUTV 2 News with this statement:
"THE UNIVERSITY OF UTAH HAS ROBUST POLICIES IN PLACE FOR DATA INTEGRITY AND SECURITY AND STAND BY THOSE POLICIES. WE BELIEVE IN OUR RESEARCH, INCLUDING OUR METHODS TO DIAGNOSE, TREAT, AND STUDY AUTISM AND ARE COMMITTED TO CONTINUED RESEARCH IN THIS AREA.”
