Main Culprit In Large Patient Information Breaches: Unencrypted Laptops

Dom Nicastro, May 17, 2010

Perhaps it's time to make laptops look unappealing to thieves to prevent them from being stolen.

"A tongue-in-cheek solution—ugly, cumbersome, low-appeal devices," says Nancy Davis, director of privacy and security officer for Ministry Health Care in Sturgeon Bay, WI. "We had a suggestion . . . to paint them all mustard yellow."

Naturally, Davis and fellow HIPAA privacy and security officers and consultants have more serious ideas about securing laptops. And most agree—encryption is the safest way to ensure your patients' protected health information (PHI) is secured before it flies out the door.

In its interim final rule on breach notification, the Office for Civil Rights (OCR), the enforcer of HIPAA's privacy and security rules, lists several methods of encryption that create a "safe harbor" in case of a breach of PHI.

But laptops remain a large source of patient information breaches.

Of the 79 entities that reported breaches of unsecured PHI affecting 500 or more individuals on the OCR website as of Friday, May 14, 20 involved a laptop (25%).

A thief stole a laptop in March that contained information about 9,600 patients from a New Mexico Medicaid program subcontractor, according to a New Mexico Human Services Department press release Tuesday, May 11.

And a Republican congressman Wednesday, May 12 sent a letter to the secretary of the Department of Veterans Affairs (VA) with concerns over two stolen unencrypted laptops in Texas over a two-week span this spring. One of the laptops contained personal identifying information of 644 veterans, according to the letter's author, Congressman Steve Buyer (R-IN).

"Providers must start taking the regulations seriously and must take the steps necessary to protect patient information, especially on these most vulnerable portable devices," says Dena Boggan, CPC, CMC, CCP, HIPAA privacy and security officer at St. Dominic Jackson Memorial Hospital in Jackson, MS. "From the portable devices security guidelines released by CMS in December 2006 to the notification of breach guidelines detailed in HITECH, the message is clear—complete your risk analysis, determine your vulnerabilities, and take the steps to correct any inefficiencies in your security policies and procedures or you may be subject to penalties for failure to do so."

In New Mexico April 9, West Monroe Partners reported an unencrypted laptop stolen from the trunk of a car in Chicago March 20. The laptop contained patient information in the New Mexico Medicaid program including:

  • Names
  • Health plans
  • Identification numbers
  • Social Security numbers
  • Provider identification numbers

The state Medicaid program sent notification letters to its members and set up a toll-free telephone line through DentaQuest to take questions. The letter explains how members can place a fraud alert on their accounts. That information is also available on the New Mexico Medicaid website.

The New Mexico breach illustrates two essential points: know to whom you are contracting your work, and have a breach notification policy in place so everyone knows their role, says Brandon Ho, CIPP, the HIPAA compliance specialist for the Pacific Regional Medical Command based at Tripler Army Medical Center in Honolulu, HI.

Dom Nicastro Dom Nicastro is a contributing writer. He edits the Medical Records Briefings newsletter and manages the HIPAA Update Blog.
Facebook icon
LinkedIn icon
Twitter icon