CCI: A Stolen Laptop, a Registry Spreadsheet, and a 60-Day Clock

A Stolen Laptop, a Registry Spreadsheet, and a 60-Day Clock

On a Monday morning, a diabetes program nurse reports that her personal laptop was stolen from her locked car overnight. The laptop was unencrypted and protected only by a four-digit PIN. It held a spreadsheet export of the program registry: 3,140 patients with name, date of birth, medical record number, most recent A1c, and a free-text "notes" column where staff had recorded entries such as "declined insulin, fear of needles" and, for 212 patients, "HIV clinic co-managed." No Social Security numbers, insurance data, or addresses were in the file. The file was created eight months ago for an outreach mailing and saved to the desktop. The organization has no policy governing registry exports. The security officer wants individual notice to all 3,140 within 60 days; the privacy officer argues that risk is low and that notice is unnecessary because the laptop required a PIN. This is the fourth potential breach in 18 months.

1. Work through the breach risk assessment and conclude whether notification is required, showing your reasoning rather than only the conclusion.

Read the worked answer

Start from the presumption. Unencrypted PHI on a stolen device is presumed to be a breach unless the organization demonstrates a low probability that the information was compromised. The burden sits with the covered entity, and the PIN does not change the analysis unless it meets the encryption standard, which a four-digit PIN does not.

Apply the four factors

Nature and extent of the PHI. Name, date of birth, and MRN together are strong direct identifiers, and they are attached to a diagnosis-adjacent data element (A1c) and free-text clinical detail. For 212 patients, HIV status is implicated, which is a category carrying documented stigma and downstream harm. This factor weighs toward notification, and heavily for the 212.
The unauthorized person. Unknown. There is no evidence the thief targeted the device for its contents, which reduces probability, but an unknown recipient cannot be assumed to be non-malicious.
Whether the PHI was actually acquired or viewed. No evidence either way. No remote monitoring, no login telemetry, no encryption. Absence of evidence is not evidence of absence; the file sat on the desktop of a device with only a PIN.
Extent of risk mitigation. None achieved to date. Encryption and remote wipe were available and are typically deployable at low cost. The fact that this is the fourth event in 18 months argues against a low-probability finding as a matter of organizational credibility.

Conclusion. A low-probability determination is defensible for none of the three groups with confidence, and is not defensible at all for the 212 patients. Notify the full 3,140. Treating the population as one cohort is operationally simpler than splitting it and reduces the risk of missing someone.

Documentation. Record the assessment, the factors weighed, the decision, and who decided. If a regulator later disagrees, a contemporaneous reasoned assessment is the difference between a defensible judgment and an unexplained decision.

2. What notifications and documentation are required, and on what timeline does each clock start?

Read the worked answer

When the clock starts. Discovery is when the incident is known or would have been known with reasonable diligence. The nurse's Monday report likely establishes it. Investigation time does not extend the outer limit; notification proceeds on available information and can be supplemented later.

Individual notice

Written notice by first-class mail to the last known address, or by email if the individual agreed to electronic notice, without unreasonable delay and no later than 60 days after discovery.
Content must include a brief description of what happened, the types of information involved, steps individuals should take to protect themselves, what the organization is doing to investigate and mitigate, and contact information including a toll-free number.
If contact information is insufficient or out of date for 10 or more individuals, substitute notice is required: a prominent website posting plus a toll-free number, and media notice if 10 or more residents of a state or jurisdiction are affected.

HHS Office for Civil Rights

If 500 or more individuals in a state or jurisdiction are affected, notify HHS concurrently with individual notice, through the OCR portal.
If fewer than 500, log the breach and report annually within 60 days of the end of the calendar year.

Media

Notice to prominent media outlets serving the state or jurisdiction without unreasonable delay and no later than 60 days, because 500 or more residents are affected.

Also check

State breach notification statute: many have shorter timelines, different content requirements, or attorney general reporting.
If the laptop held email or other systems credentials, treat as a security incident requiring credential reset.
Internal documentation: the risk assessment, the notice copies, the contact list, and a log of the decision.

Common error to avoid. Do not wait for a forensic report that will never be conclusive. The deadline is a ceiling, and 60 days is the maximum, not a target.

3. What corrective actions address the underlying cause rather than this one laptop, and how would you sequence them given four incidents in 18 months?

Read the worked answer

Diagnose before prescribing. Four events in 18 months is a systemic pattern, not four lapses. Group them by mechanism: device loss, export to local storage, email misdirection, or access control. The common thread here is uncontrolled local copies of PHI on personally owned equipment, which points to missing technical controls and a policy gap the staff filled on their own.

Technical controls, in order of effect per unit of effort

Full-disk encryption enforced by policy on any device that touches PHI, with remote wipe and device management. Encryption is nominally addressable under the Security Rule, but with four prior events the organization cannot justify skipping it.
Block or log exports of PHI to removable and local media; apply data loss prevention to email.
Provide a sanctioned alternative before removing the workaround: a registry report inside the EHR or BI environment, or a secure enclave, so the diabetes team can still do outreach.

Administrative controls

A written policy on registry extracts: approval, purpose, minimum necessary content, security requirements, retention, and destruction.
De-identification by design for outreach mailings: strip name, MRN, and full date of birth, replace with a study identifier and a key held in a secured system. This removes the reporting obligation for routine work rather than relying on good behavior.
Workforce training targeted at the actual failure (portable devices and file handling), not a generic annual module.
Enforce the existing sanctions policy consistently, including for managers who tolerated the export.

Sequence Days 1-30: encryption and device management rollout, suspend unapproved exports, stand up the sanctioned reporting path for the diabetes team. Days 30-90: policy, training, data-loss-prevention rules, and a tabletop exercise to test the breach response plan. Day 90+: audit exports quarterly and report device inventory completeness to leadership, since the prior three events were presumably also followed by training. If the audit finds the same pattern, escalate to requiring approval at the executive level before further remediation spending.