The Lost USB Drive
Sarah is a healthcare administrator at a clinic. She needs to transfer patient records to a specialist's office. The clinic's IT policy prohibits sending patient data via email unless encrypted. Sarah decides to copy the records onto a USB flash drive. She uses a personal USB drive that she found in the parking lot, thinking it was a lucky find. She copies the files, which include names, addresses, and medical diagnoses, without encrypting them. She then takes the USB drive to the specialist's office but loses it in the parking lot. The next day, a stranger finds the USB drive and plugs it into a public computer. The files are accessible without any password. The clinic later discovers the breach when the stranger posts some of the records online.
1. What were Sarah's mistakes in handling the patient data, and what clinic policies were violated?
Read the worked answer
- Using a found USB drive: Sarah used an untrusted device that could have been infected with malware, posing a risk to the clinic's systems. She should never use unknown removable media.
- Not encrypting the data: Patient records are sensitive and must be encrypted both at rest and in transit. The clinic likely has a policy requiring encryption for portable devices.
- Violating email policy: Although she didn't use email, the policy's intent is to protect data during transfer; using an unencrypted USB drive is equally risky.
- Lack of physical security: She lost the drive, failing to safeguard it.
- Not following proper transfer procedures: The clinic likely has a secure method for sharing patient data (e.g., encrypted email, secure file transfer).
- Potential HIPAA violation: In the US, this could be a breach under HIPAA, requiring notification.
2. What should Sarah have done instead to transfer the patient records securely? Describe at least two secure methods.
Read the worked answer
- Use encrypted email: Send the records via email with encryption (e.g., using S/MIME or a secure messaging portal) so that only the intended recipient can decrypt them.
- Use a secure file transfer service: Many healthcare organizations provide HIPAA-compliant file transfer tools that encrypt data in transit and at rest, with audit trails.
- Use an encrypted USB drive: If a physical device is necessary, use a clinic-issued, hardware-encrypted USB drive with a strong password, and never use a found device.
- Verify recipient: Confirm the recipient's identity and secure reception method before sending.
- Follow clinic policy: Adhere to the organization's data transfer policy, which likely outlines approved methods.