HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

U.S. HealthWorks Announces Theft of Encrypted Laptop and Decryption Key

Healthcare providers can use data encryption to ensure that the theft of portable devices does not result in the exposure of patients’ protected health information. However, encryption is not infallible, as U.S. HealthWorks has discovered.

A laptop computer containing the PHI of 1,400 patients was recently stolen from a U.S. HealthWorks employee. While this would not usually result in the issuing of breach notifications to patients, in this case the employee had written down the password to access the device and decrypt data. The password was kept with the laptop and it was also stolen.

Upon discovery of the theft of the device along with the password, U.S. HealthWorks conducted a full investigation to determine which patients may have had their PHI exposed.

The investigation did not uncover evidence to suggest that any data have been used inappropriately, and the possibility remains that the data stored on the device were not accessed. However, if the thief were to use the password to gain access to the device, it would be possible to access emails which contained sensitive information on patients.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The emails contained a limited amount of PHI including names and medical information such as visit dates, medical diagnoses, and health insurance information. Some patients may also have had their Social Security number exposed, although no financial information or other account details were present in any of the emails on the device.

U.S. HealthWorks is taking steps to reduce the risk of future security breaches by re-training employees on information security. Policies and procedures have also been reviewed and are being revised as appropriate, in particular policies and procedures regarding the security of laptop computers and the use of passwords.

The theft occurred on July 18, 2016 and patients were notified of the potential exposure of their PHI on September 2, 2016.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.