HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Theft of Unencrypted Laptop Potentially Results in PHI Exposure

An unencrypted laptop computer has been stolen from the vehicle of an employee of Bassett Family Practice in Virginia, potentially resulting in the exposure of patients’ protected health information.

The theft is understood to have occurred over the weekend of 12/13 August. Patients were notified of the exposure of their data on October 13, 2017. The delay in issuing notifications was due to the time taken to recover the missing files from backups and to analyse those files to determine which patients had been affected and the types of PHI stored on the device.

The laptop computer was discovered to contain some information about patients’ visits to the practice, along with their names, date of birth, account number, and their insurance provider’s name. The laptop also contained information related to account balances. No Social Security numbers or credit or debit card information were stored on the device.

It is not company practice to store any protected health information on laptop computers. The files were transferred to the device as Bassett Family Practice was transitioning to a new IT system. The practice was also in the process of encrypting all of its laptop computers.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

HIPAA does not demand that data encryption is used to protect stored data, even when PHI is stored on portable devices that are removed from healthcare facilities. Data encryption must be addressed, and if the decision is taken not to encrypt data, the decision must be documented. An alternate, equivalent measure must then be used in place of encryption.

Bassett Family Practice had installed a system that would send a notification if any data access occurred, and no notification has been received. In the event that the thief does attempt to access sensitive data stored on the device, the practice can remotely wipe the device. The risk of patients’ PHI being accessed and misused is therefore believed to be low.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.