The Lost Laptop and the Encrypted Backup
A 60-person home health agency issues laptops to field nurses. One laptop is stolen from a nurse's locked car. The laptop held a local copy of the EHR database for 1,200 patients, including names, addresses, diagnoses, and Social Security numbers. The laptop's hard drive was not encrypted, but the agency's central server is encrypted and the laptop synced nightly. The agency has a written security policy requiring encryption on mobile devices; the IT vendor deployed encryption to 40 of 60 laptops and ran out of licenses. The nurse had reported the theft to her supervisor, who mentioned it in a team meeting three days later. The privacy officer learns of it on day four.
1. Is this a reportable breach? Walk through the Breach Notification Rule analysis, including the encryption exception.
Read the worked answer
Step 1 - Impermissible disclosure? Theft of a device containing PHI is a presumed breach unless the data was secured.
Step 2 - Encryption exception. The Breach Notification Rule's 'secure' exception applies only when PHI is rendered unusable, unreadable, or indecipherable to unauthorized persons - typically through encryption at rest meeting NIST guidance. Here the laptop's drive was not encrypted. The fact that the server is encrypted is irrelevant: the stolen copy was plaintext. The exception does not apply.
Step 3 - Presumption of breach. The agency must either notify or demonstrate a low probability of compromise through a four-factor risk assessment: (1) nature and extent of PHI (SSNs, diagnoses - high sensitivity); (2) the unauthorized recipient (unknown thief); (3) whether the data was actually acquired or viewed (unknown); (4) mitigation (none yet). SSNs plus diagnoses plus no encryption makes a low-probability finding very hard to defend. Notify.
Step 4 - Timing. Notification is due without unreasonable delay and no later than 60 days from discovery. 'Discovery' is when the incident is known or should reasonably have been known - arguably the supervisor's knowledge on day one, not the privacy officer's day four. The clock is already running.
2. Identify the governance failures and explain how they affect the agency's exposure.
Read the worked answer
Several failures, each of which a regulator will treat as an aggravating factor:
- Policy without enforcement. The agency had an encryption policy but deployed it to only 40 of 60 laptops. A policy the organization knowingly does not follow is worse than no policy, because it shows the risk was identified and not addressed.
- License gap. Running out of encryption licenses is a budget decision, not a legal excuse. The agency should have tracked which devices were unprotected.
- Delayed internal reporting. The supervisor heard on day one and the privacy officer learned on day four. The agency needs a clear incident-reporting pathway so that 'discovery' happens promptly. Delay compresses the 60-day window and looks like concealment.
- No device inventory / remote wipe. The agency should be able to say which devices hold PHI and whether they can be wiped remotely.
Exposure: HHS civil money penalties scale with culpability, and 'reasonable cause' or 'willful neglect' findings are more likely when a known risk was left unaddressed.
3. What should the agency do in the first 30 days, and what should it do longer-term?
Read the worked answer
First 30 days:
- Contain: attempt remote wipe if possible; confirm what data was on the device.
- Document the four-factor risk assessment and the notification decision.
- Notify affected individuals (1,200) without unreasonable delay; include the required content (what happened, what PHI, what the individual should do, what the agency is doing, contact info).
- Notify HHS. Because the breach affects 500 or more individuals, HHS must be notified contemporaneously with individual notice (not the annual log used for smaller breaches).
- Consider media notice if 500+ residents of a state or jurisdiction are affected.
- Offer credit monitoring given SSN exposure.
Longer term:
- Encrypt the remaining 20 laptops before they go back into the field.
- Build a device inventory and remote-wipe capability.
- Establish a single incident hotline and a written triage procedure with a defined 'discovery' trigger.
- Train supervisors that a reported theft is an incident, not a team-meeting anecdote.
The through-line: the agency must be able to show it changed the condition that caused the breach.