When a device containing protected health information (PHI) is lost or stolen, it's generally considered a security incident that requires immediate evaluation. However, whether it constitutes a reportable HIPAA breach depends on several factors.
The University of Texas MD Anderson Cancer Center v. U.S. Department of Health and Human Services (2021), case is an example of the consequences of inadequate device security in healthcare settings. In 2021, the center faced a $4.3 million penalty for HIPAA violations stemming from three separate incidents involving lost or stolen unencrypted devices. Between 2012 and 2013, an unencrypted laptop was stolen from a physician's home, and two unencrypted USB drives were lost, collectively exposing the PHI of over 33,500 patients.
According to a Notice of Proposed Determination by the Department of Health and Human Services (HHS), MD Anderson had maintained written encryption policies since 2006 and had even purchased encryption software. However, they failed to implement these measures consistently across their devices. Their own risk analyses conducted between 2006 and 2011 had explicitly identified the lack of encryption as a serious security vulnerability, yet the organization failed to take corrective action.
The court's ruling was noteworthy as it rejected MD Anderson's argument that they weren't legally obligated to encrypt devices. The Office for Civil Rights (OCR) classified these violations as "willful neglect," emphasizing that merely having security policies on paper is insufficient – organizations must actively implement and maintain their security measures.
If the lost device was encrypted to HIPAA standards, the loss typically doesn't constitute a reportable breach. This is because properly encrypted PHI remains inaccessible. However, encryption must be validated and documented before making this determination.
As former OCR Director Roger Severino stated in a press release: "Laptops, cellphones, and other mobile devices are stolen every day, that's the hard reality. Covered entities can best protect their patients' data by encrypting mobile devices to thwart identity thieves." This guidance comes from lessons, as demonstrated in the 2017 Lifespan Health System case, where an unencrypted MacBook stolen from an employee's car led to the exposure of 20,431 patients' data and resulted in a million-dollar settlement.
Learn more: What devices must be encrypted for HIPAA?
Device security measures include:
As former Twitter and Mozilla CISO Michael Coates notes, "When you see (security breaches) in the news and think, 'What should we do?' it's not that you need to have the most advanced new technology that doesn't exist. You need to go back to basics and say, 'We know what we need to do.' It's strong passwords. It's hashing. It's good security practices."
Learn more: What is mobile device management?
According to the Centers for Medicare and Medicaid Services (CMS), “The unpermitted use or disclosure of PHI is a breach unless there’s a low probability the PHI has been compromised, based on a risk assessment of: The nature and extent of the PHI involved, including types of identifiers and the likelihood of re-identification; The unauthorized person who used the PHI or got the disclosed PHI; Whether an individual acquired or viewed the PHI; The extent to which you reduced the PHI risk.”
Therefore, organizations must evaluate:
For example, in the Lifespan case, the exposure assessment revealed that thieves had access to:
The consequences of a HIPAA violations are than just penalties. Different healthcare cybersecurity sources provide the following information:
A systematic analysis of failures in protecting personal health data: A scoping review, published in ScienceDirect, examines factors contributing to reputational damage in healthcare organizations:
In The Future of Patient Data Security: Exploring Emerging Technologies and Collaborative Approaches, Naga Vinodh Duggirala presents the following emerging technologies for protecting PHI:
A study by the National Institutes of Health (NIH) on mobile device security and the perspectives of future healthcare workers found that healthcare professionals have a complex relationship with mobile device security, characterized by “perception-action gaps”. While 76 percent recognize potential dangers to personal information and 87 percent view a security breach as a privacy invasion, only 42 percent actively implement security safeguards.
Additionally, technological competence reveals mixed results, with 82 percent believing security safeguards are effective, but only 36 percent knowing how to obtain them. Knowledge about specific protection mechanisms differs: 61 percent understand password or biometric access control, but merely 29 percent know how to protect against malware, and 27 percent comprehend encryption's security benefits. Despite 70 percent recognizing the importance of backup and recovery systems, only 33 percent are knowledgeable about anti-theft applications.
According to The Future of Security in a Remote-Work Environment by the NIH, “Pew Research recorded a 51% increase in the number of people working from home, a total of 71% of all participants surveyed. In the same study, 54% of people said they would prefer to work from home going forward. Although this was not indicative of whether or not their companies would let them go remote or to what degree, it was indicative of the remote-work trend. Several security risks immediately are brought to the forefront as issues that companies should consider.”
The security risks mentioned by the NIH article include:
Learn more: HIPAA and mobile devices
No, not every lost device automatically constitutes a HIPAA violation. If the device was properly encrypted to HIPAA standards, the loss typically isn't considered a reportable breach since the PHI remains inaccessible.
Organizations should immediately report the incident to their Privacy Officer, document all known details, attempt to remotely wipe the device if possible, conduct a risk assessment, and determine if breach notification is required.
Remote wiping is a security feature that allows an organization to erase data from a lost or stolen device to prevent unauthorized access.
Cloud security often provides stronger encryption, automated updates, and scalable protections that surpass traditional on-site storage solutions.
While cloud security significantly reduces risks, no system is completely breach-proof, so continuous monitoring and strong access controls are essential.