The Laptop, the Spreadsheet, and the Four-Factor Test
On Monday morning the privacy officer learns that a clinician's personal laptop was stolen from her car the previous Friday. The laptop was full-disk encrypted, but the clinician had exported a spreadsheet to the desktop for a quality-improvement project: 3,200 patients with name, date of birth, MRN, diagnosis code, insurance ID, and the last four digits of the SSN. Four hundred eighty rows are from the HIV clinic. A copy of the spreadsheet also sits in the clinician's personal cloud account, which she says is 'password protected,' and she had emailed the file to her personal email account 'to work on at home.' The theft was reported to campus police Friday, the clinician told her manager Sunday, and the manager emailed the privacy office Sunday night. The CEO wants to 'wait until we know more.'
1. Establish the discovery date, the applicable clock, and who must be notified and when.
Read the worked answer
Discovery is when the entity knew or should have known - Sunday night, not Friday. The theft alone is not the breach; the unencrypted exported file is.
- Individuals: notify without unreasonable delay and no later than 60 days from discovery, in plain language covering what happened, what data was involved, what individuals should do, and whom to call.
- HHS: because 500 or more individuals are affected, notify HHS concurrently with individual notice through the portal.
- Media: more than 500 residents of the state are affected, so notify prominent media outlets serving the state without unreasonable delay and within 60 days.
- State law: SSN fragments and HIV diagnoses trigger separate state breach statutes with their own content, timing, and attorney general notice requirements.
The CEO's 'wait until we know more' is not an option the regulation offers. Investigate and notify in parallel, and document what was known at each point. Delay to preserve reputation is the fact pattern that turns a breach into an enforcement case.
2. Apply the four-factor risk assessment. Is this a reportable breach?
Read the worked answer
Encryption safe harbor does not apply: the exported spreadsheet was not encrypted at rest, whatever the laptop's disk did. The breach is therefore presumed unless the group can demonstrate a low probability of compromise under all four factors - and the burden is on the group.
- Nature and extent of PHI. Names, dates of birth, MRNs, diagnosis codes, insurance IDs, and SSN fragments, including 480 HIV diagnoses. Highly sensitive, directly identifying, and sufficient for insurance and identity fraud.
- Unauthorized recipient. Unknown - a thief. There is no basis to conclude the person is unable or unlikely to retain the information.
- Whether the PHI was actually acquired or viewed. Unknowable without forensics. Device logs may show whether the file was opened, but absence of evidence is not evidence of no access.
- Extent of mitigation. Weak: a personal cloud copy and an email copy persist, and the clinician's personal accounts are outside the group's control.
Conclusion: the group cannot carry its burden. Treat it as a reportable breach for all 3,200 individuals. Risk tiers may shape the content and services offered, but they should not be used to withhold notification from a subset.
3. What immediate containment, investigation, and workforce steps should follow?
Read the worked answer
Contain first, investigate second, sanction last - and document throughout.
- Containment. Remote wipe if still possible, revoke the clinician's remote access and cloud tokens, preserve the police report and laptop serial number, and have her delete the email and cloud copies with written confirmation. Determine whether those personal accounts must be treated as part of the investigation.
- Scope. Interview the clinician, confirm where the quality project was authorized to store data, and search email and endpoint logs for other outbound sends of PHI to personal accounts by anyone else.
- Workforce. Apply the sanction policy consistently. This is a minimum-necessary and safeguard failure, not the theft itself. Consider retraining, monitoring, and access restriction before termination, and record the reasoning either way - inconsistent sanctions are a discrimination claim waiting to happen.
- Root cause. Remove local export for that role, or log and alert on it. A policy that says 'do not export' without a control is not a safeguard.
- Recordkeeping. Log the incident, the risk assessment, the notification decision, and the dates, whether or not notification was required.