This is a bit hard to understand what 's going on . The hospital alleges that a former IT director kept a hard drive with patient info as retribution . The IT director alleges that he dropped the hard drive off to the org and it was sent to him in his personal effects after termination . The only thing we really know is that he was n't supposed to have it and he did , which is at least a loss of possession / control . ;