HCA 310 Module 7 HIPAA Security and a Breach Case Example

A Laptop in a Parked Car: HIPAA Security Safeguards and a Breach Case Study

Student Name

Health Care Administration Program, Aspen University

HCA 310: HIPAA and Electronic Health Records

Instructor Name

Month Day, Year

A Laptop in a Parked Car: HIPAA Security Safeguards and a Breach Case Study

The HIPAA Security Rule protects electronic health information through safeguards that are meant to prevent breaches, and the Breach Notification Rule tells covered entities what to do when prevention fails. This paper summarizes the Security Rule's safeguards and then analyzes a composite breach at an orthopedic practice: a laptop holding thousands of patients' records was stolen from a staff member's car. The case shows how a single gap in safeguards becomes a costly and public event.

The Security Rule

The Security Rule asks every covered entity to keep electronic patient data private, unaltered and available when needed, using three families of safeguards, and to start with a risk analysis of where its data could be exposed (U.S. Department of Health and Human Services, 2022). Administrative safeguards include policies, training and a security official. Physical safeguards control access to facilities, workstations and devices. Technical safeguards include access controls, audit controls, integrity protections and transmission security.

The Breach

On a Friday evening, the practice's billing specialist stopped at a store on her way home. Her work laptop, which she used to finish reports at home, was in a bag on the back seat. When she returned, the window was broken and the bag gone. The laptop held a spreadsheet with 2,300 patients' names, dates of birth, insurance numbers and diagnosis codes exported for a billing project. The laptop was password protected but not encrypted.

Discovery and First Steps

She reported the theft to police that night and called the office manager, who is also the privacy and security official, on Saturday morning. The manager had the IT vendor disable the laptop's accounts and change her passwords, documented the facts and began a risk assessment. The notification clock starts on the day the practice learns of the loss, or the day it reasonably should have learned of it.

Was It a Breach?

Federal rules treat any improper release of unprotected patient data as a breach by default; the practice can escape notification only by documenting that compromise is unlikely. The assessment considers the nature of the information, who obtained it, whether it was actually viewed and how far the risk was mitigated. Because the laptop was unencrypted, the data were unsecured, the thief's intent was unknown and the information included insurance numbers, the practice concluded it could not show a low probability of compromise.

Notification

Each affected patient must get a letter quickly, never later than the 60th day after discovery; when more than 500 people in one state are affected, local media must also be told; and large breaches must be reported to the federal health department within the same 60 days (U.S. Department of Health and Human Services, 2023). The practice mailed letters to all 2,300 patients, notified local media and filed the federal report.

Timeline

The table summarizes the response.

What the Letters Said

Each letter explained the theft, listed the data on the laptop, described the practice's response, suggested steps patients could take, such as watching insurance statements for services they did not receive, and how to reach the practice's call line. The letters were written in plain language and offered in Spanish.

Root Causes

The investigation found three gaps. Laptops were not encrypted, although encryption would have made the data secured and likely avoided a reportable breach. Staff were allowed to export large patient lists without approval. The practice had no rule against leaving devices in vehicles. Each gap was an administrative, physical or technical safeguard that the risk analysis should have addressed.

Corrective Action

The practice encrypted all laptops and mobile devices, restricted exports to approved reports stored on the secure server, adopted a policy forbidding devices from being left unattended in vehicles, updated its risk analysis and retrained all staff. It also began quarterly checks that encryption remains active on every device.

Other Threats

Theft is only one route to a breach. In simulated phishing campaigns at US health care institutions, about one in seven test emails was clicked, although repeated campaigns lowered the odds of clicking (Gordon et al., 2019). Ransomware attacks on health care providers exposed data on nearly 42 million patients from 2016 to 2021 (Neprash et al., 2022). The practice added phishing simulations to its training.

Costs of the Breach

The practice spent staff time, legal fees, mailing costs and call line costs, and it faced the possibility of a federal investigation and penalties. Some patients transferred their care. The cost of encrypting every device beforehand would have been a small fraction of the response.

Lessons for a Small Practice

Encrypt every device that stores patient information. Limit how much data can be exported and where it can be kept. Include physical risks, such as vehicles and homes, in the risk analysis. Train staff with realistic scenarios. Know the notification deadlines before a breach happens, so the response does not begin with research.

Business Associates

Vendors that handle the practice's patient information, such as the billing service, IT vendor and cloud record host, are business associates. Each must sign an agreement to protect the information and report breaches to the practice. The practice's risk analysis includes how business associates store and transmit data.

Testing the Response Plan

The practice now tests its breach response plan once a year with a tabletop exercise, walking through a scenario such as a misdirected email or lost phone. The exercise checks that staff know whom to call, where the risk assessment template is and how to meet notification deadlines.

Conclusion

The Security Rule's safeguards exist to prevent exactly the kind of breach the orthopedic practice suffered. One unencrypted laptop, one large export and one unattended car turned into a reportable breach requiring notice to 2,300 patients, the media and federal regulators. Encryption, export limits, device policies, a current risk analysis and training would have prevented it, and now protect the practice going forward.

References

Gordon, W. J., Wright, A., Aiyagari, R., Corbo, L., Glynn, R. J., Kadakia, J., Kufahl, J., Mazzone, C., Noga, J., Parkulo, M., Sanford, B., Scheib, P., & Landman, A. B. (2019). Assessment of employee susceptibility to phishing attacks at US health care institutions. JAMA Network Open, 2(3), Article e190393. https://doi.org/10.1001/jamanetworkopen.2019.0393

Neprash, H. T., McGlave, C. C., Cross, D. A., Virnig, B. A., Puskarich, M. A., Huling, J. D., Rozenshtein, A. Z., & Nikpay, S. S. (2022). Trends in ransomware attacks on US hospitals, clinics, and other health care delivery organizations, 2016-2021. JAMA Health Forum, 3(12), Article e224873. https://doi.org/10.1001/jamahealthforum.2022.4873

U.S. Department of Health and Human Services. (2022). Summary of the HIPAA security rule. https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html

U.S. Department of Health and Human Services. (2023). Breach notification rule. https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html