A New York state employee stole about $100,000 worth of goods and services last year, using her position as a clerk with the state's insurance department to access the personal information of state employees and other citizens who dealt with her office. She used the information to open new charge accounts, and then charged away.

The clerk was quickly arrested, preventing a loss that could have been even more substantial, according to the New York Attorney General's office. Given the time, the clerk could have accessed thousands of personal identifying information from the state's computers.

The incident was a wake-up call to all employers, both public and private, who need to be ever more vigilant about who should be allowed access to personal employee and customer information.

In fact, there's been an alarming, dramatic growth in reported identity thefts. Calls to the Federal Trade Commission's (FTC) clearinghouse complaining about identity theft, for example, has grown five-fold to as many as 3,000 reports per week, according to a Government Accounting Office report. The theft of business records, such as payroll or employment records, is becoming one of identity thieves' most popular sources for information.

One solution? Businesses need to use every method at their disposal to reduce access to employee information.

"The business community really must become the first line of defense," said Linda Foley, executive director of the Identity Theft Resource Center in San Diego, California, a national nonprofit organization dedicated to combating identity theft and providing information and prevention training to businesses and individuals. (www.idtheftcenter.org). "It's how businesses acquire, distribute and store personal information, and how they use it, sell it and dispose of it that puts us all at risk," Foley said.

Foley notes with particular ire that it's unfair for businesses to put consumers at risk by failing to take obvious steps to protect them.

The two main ways to prevent identity theft in the workplace are to stop using employees' Social Security numbers on all personnel and payroll records and to destroy thoroughly any records containing sensitive personal information — not just store it in a box or throw it in the trash.

In some states, laws are changing to require these measures. California, for example, has passed a law that prohibits printing or using employee or customer Social Security numbers on documents where they may be seen by others such as on identification cards or badges or other employee materials. For example (with some exceptions for health care or insurance companies), individuals and non-government entities may not:

• publicly display or post SSNs
• require people to transmit an SSNs over the Internet unless the connection is secure or the number is encrypted
• require people to log onto a Web site using an SSN without a password
• print SSNs on anything mailed to a customer unless required by law or the document is a form or application.

Georgia has passed similar laws, and federal legislation has also been proposed.

"In the past, a Social Security number often was used unnecessarily as a cross reference on a variety of documents, even when a name would have provided sufficient identification," said Gail Jern, Westaff's Human Resources representative. "The fewer places that social security numbers are recorded, the less apt they are to be seen by others and/or confiscated for illegal purposes."

Personal information stored on computer is also at risk. In one of the biggest thefts of personal records so far, the University of Texas at Austin had the Social Security numbers and other personal records of 55,000 student, faculty and staff captured by computer hackers last month, according to the university.

Although the breech was quickly discovered, it may not be known for several months whether that information was disseminated to identity thieves. "The hackers could have sold it within 20 minutes," said Foley.

But the people who may have bought the information "may sit on it and not use it for six more months," she said.

Access and honesty are both critical factors in preventing identity theft, and companies need to take steps to address both issues.

Jern noted that companies should designate only a very limited number of people with the authority to access employees' personal information. "Hiring honest and ethical employees, and keeping them motivated and feeling appreciated can make a significant difference in terms of their loyalty," she said. "This also underscores the importance of a company having good hiring practices and taking the time to do thorough reference checks."

Foley believes the business community's handling of sensitive personal information is going to change either voluntarily or because of new government policies and laws that provide more protections for personal information.

In any case, she said, it's in businesses' own interests to prevent the theft of their employees' or customers' identities.

"We don't come in to rap businesses' knuckles," said Foley of her organization's approach to helping companies prevent identity theft. "We just explain to them what aspects of their record-keeping should be looked at and offer them ideas about how to improve them. But we also point out that it would be more cost effective to fix any (record keeping) problem up front, rather than have to fix it after a class action lawsuit is filed by victims whose information was stolen," she said.

Another thing her organization doesn't do is pry into companies' actual employee records — that would amount to another breech in the system. "Their records are none of our business as long as they fix the problems," she said.