Lost Tablet with Written PIN at a Hospital
A hospital's IT service desk receives a call from a nurse: a physician's tablet, used to access patient records, was left in a public cafeteria and is missing. The tablet is encrypted and requires a 6-digit PIN, but the physician had written the PIN on a sticky note attached to the tablet case. The hospital's incident management policy defines an incident as 'any event that could lead to unauthorized access to protected health information.' The service desk agent logs the ticket as a low-severity incident and informs the physician to change their password. No further action is taken for 36 hours, until a patient complains that their records were accessed from an unknown location. The privacy officer asks whether the initial handling was consistent with ISO/IEC 27035.
1. Using ISO/IEC 27035 definitions, was the missing tablet an event or an incident at the time of the call? Justify your answer.
Read the worked answer
At the time of the call, the missing tablet was an information security event that had a high likelihood of being an incident. 27035 defines an event as an identified occurrence indicating a possible breach of security; an incident is an event or series of events with a significant probability of compromising business operations and threatening information security. The tablet contained access to patient records, was encrypted, but the PIN was written on the case-defeating the encryption. The hospital's own policy defines an incident broadly as any event that could lead to unauthorized access to PHI. Therefore, the service desk should have treated it as an incident (or at least a potential incident requiring immediate assessment). The agent's classification as low severity and the 36-hour inaction are inconsistent with 27035's requirement for timely assessment and response. The fact that unauthorized access later occurred confirms the risk was real. The key is that the written PIN created a significant probability of compromise, not just a theoretical possibility.
2. What should the service desk agent have done differently according to 27035 detection, reporting, and assessment processes?
Read the worked answer
The agent should have: (1) reported the event immediately to the incident response team or security officer, not just logged a ticket; (2) assessed the impact using defined criteria-device contains PHI, PIN exposed, theft likely-and assigned a high severity; (3) escalated to the privacy officer and incident manager; (4) initiated response actions such as remote wipe of the tablet, disabling the physician's credentials, and checking access logs for the patient records; (5) documented the timeline and decisions. 27035 expects detection to trigger reporting and assessment within defined timeframes. Changing the physician's password alone is insufficient because the tablet may still be accessible and the breach may already have occurred. The agent also should have preserved evidence (e.g., the call details, device ID, last known location).
3. What policy or procedural gaps does this reveal?
Read the worked answer
Several gaps: (1) Ambiguous severity criteria-the policy defines an incident broadly but does not provide examples or a classification matrix for lost devices with PHI; (2) No mandatory escalation path for privacy-related incidents; (3) Lack of training for service desk staff on 27035 event vs. incident and reporting; (4) Insufficient technical controls-writing a PIN on a device should be addressed by biometric or complex passcode policy, and remote wipe should be automatic; (5) No monitoring of access logs that would have detected the unauthorized access sooner. The policy should require immediate escalation for any lost device containing PHI, with a defined response checklist and timeframes. It should also clarify that encryption is not sufficient if the key is stored with the device.