The Stolen Laptop and the Expired License
Trent is a private investigator in Helena. His license expired on March 31. He kept working on four cases through May because he believed his renewal 'was in the mail.' On May 15 his laptop bag was stolen from his locked car. The bag contained case notes with a client's mental-health records, a signed authorization, and a subject's Social Security number. Trent did not notify the clients. He posted a reward on social media and offered $200 for the bag's return, describing it as containing 'confidential PI files.' A client saw the post, realized her records were exposed, and complained to the Board. The Board sent Trent a letter asking for a written response and copies of his case records. Trent has not responded because he is embarrassed.
1. What are the licensing consequences of working after March 31?
Read the worked answer
A license is not effective after its expiration date unless the Board has renewed it. Working on four cases through May is unlicensed activity, even if Trent believed the renewal was in the mail and even if he had no bad intent. The Board can discipline him for practicing without a license and for any false statement on a renewal. He should stop all investigative work immediately, confirm his status with the Board, and not accept new clients. If his renewal was actually approved, he should provide proof; if it was not, he needs to apply and wait. The expired period cannot be cured retroactively by paying a late fee, though the Board may consider his cooperation.
2. What are Trent's obligations after the theft?
Read the worked answer
He must take the theft seriously. He should report it to police immediately, preserve the police report number, and notify affected clients without unreasonable delay. Montana's data-breach notification law may require notice to affected individuals and to the Attorney General when personal information is acquired by an unauthorized person; the mental-health records and SSN raise that risk. He should also notify any client whose records were in the bag so they can protect themselves. He should not post details on social media that confirm the contents. He should secure remaining records, change passwords, and document the breach response. If a client is a covered health-care provider, HIPAA obligations may also apply through the client.
3. How should Trent respond to the Board's letter?
Read the worked answer
He should respond in writing by the deadline, even if he is embarrassed. Ignoring the Board is itself a disciplinary problem. He should provide the requested records, a chronology, proof of his license status, the police report, and a description of his breach response. He should admit the expired-license work and the delayed notification rather than minimize them. He can explain his misunderstanding but should not blame the mail. He should ask whether the Board wants additional information and cooperate with any investigator. He should consult counsel if criminal exposure is possible. A candid response with corrective action is better than silence, though it does not erase the violations.