I work as the sole IT person for a smallish company(50 - 70 employees). We deal in medical supplies and equipment and as such all of us here handle sensitive data pretty much constantly. I will have to provide a little background to fully explain my situation, I will try to be concise:
December 2014: A good friend of mine who was working with the company as a marketer mentions to myself and a few others that she will be leaving the company to start her own medical supply company. Despite her initial desire to keep things under-wraps till she turned in her resignation, boss found out pretty quickly from another coworker. No action was taken by boss, nothing changed.
April 2015: On 4/1/15, my friend turns in her resignation and 2-week notice and formally informs the boss and owner of her intention of leaving to start her own business; her last day being 4/14/15.
Incident: On Friday 4/10/15, 1 hour before the end of the day, the boss calls my friend in for a meeting. At about the same time I also get called into a meeting but in a separate room. After a few minutes of waiting, an individual I have never met before came into the room with one of the company managers (not my direct manager as I do not have one other than the boss). This individual identified herself as an attorney and then proceeded to ask me if I knew my marketer friend who was leaving to which I answered yes as she was a friend of mine. Attorney then proceeds to inform me that she is being accused of stealing patient data and that I am being implicated saying that I stole the data for her. I was completely blindsided by the accusation and shocked. The attorney then asked me to write a statement saying I had not provided my friend with any of the company's data. After the statement I was escorted to my vehicle and told to not mention the exchange to anyone and to go home.
By the following Monday I was complete wreck from stressing out about how this all came to place. I arrived to work to find that some folks from an 'IT company' were hired to come and look at the server and PCs and ensure that there was no data breach. Ultimately, their answer was 'inconclusive'.
Since the event, my boss took a rather negative attitude towards me which since then has sort of fizzled out (IMO) as a result of my working rather hard for this company and constantly going above and beyond my calling.
When I received my yearly review this year, after not mentioning anything about the event, boss decides to say, in the middle of the review no less, '... you know, I am still not over what happened back in april with the data breach... I cant say that I dont think you did it...'
I feel extremely deflated and a big part of me wants to talk to a lawyer but... I am not even sure what I can do or if its worth bothering with.
I have been looking for another job recently, but I feel like leaving is cowardly... thoughts? advice? anything?