An unencrypted laptop device has been stolen from the automobile of an staff worker of Bassett Family Practice in Virginia, possible leading to the exposure of the protected health information of the Practice’s clients.
It is believed that the device, a laptop computer, was stolen during the weekend of 12/13 August. Patients were advised of the possible exposure of their private health data on October 13, 2017. The two-month delay in sending notifications was due to the time taken to recover the missing files and information from backups and to analyse those files to see which clients had been placed at risk and the types of PHI stored on the laptop.
The computer was found to store some details about patients’ appointments with the practice, along with their names, date of birth, account number and their insurance provider details. The laptop also held information the referred to account balances. No Social Security numbers or credit or debit card details were stored on the laptop device.
It is not company policy to store any protected health details on laptop computers. The files were transferred to the device as Bassett Family Practice was moving to a new IT infrastructure. The Bassett Practice was also in the process of encrypting all of its laptop computers.
It is not mandatory under HIPAA that data encryption should be used to secure stored data, even when PHI is held on portable devices that are taken from healthcare facilities. Data encryption must be considered, and if the decision is taken not to encrypt data, the decision, and reasons behind it, must be recored. An alternate, equivalent measure must then be used as an alternative means of security to encryption.
Bassett Family Practice had implemented a system that would issue a notification if any data access happened, and no notification has been received. Should it happen that the thief does attempt to access private personal data stored on the device, the practice can remotely wipe the information on the device. The danger of patients’ PHI being viewed and misused is therefore believed to be minimal in this case.