Stolen Unencrypted Laptop Leads to $1.04 Million Fine by OCR

In yet another example of the importance of encrypting mobile devices and laptops, a small Rhode Island healthcare system called Lifespan ACE has agreed to pay $1.04 million to the Office for Civil Rights (“OCR”) to settle an investigation resulting from an unencrypted MacBook laptop computer that was stolen in 2017. The OCR is a subdivision of the federal Department of Health and Human Services. Among other tasks, the OCR monitors and enforces medical patient privacy rights protected by the Health Insurance Portability and Accountability Act (“HIPAA”). See 45 CFR §§160, 162 and 164.

The MacBook was owned by Lifespan and was provided to an employee for work use. The laptop was stolen when an unknown person broke into the employee’s car. The laptop was never recovered. Lifespan opened an internal investigation and determined that the employee’s work emails MIGHT have been cached on the laptop’s hard drive. Such emails would have given the thief access to HIPAA-protected information including:

Patient names
Medical record numbers
Demographic information including addresses
Names of prescribed and/or administered medications
And more

Data for about 20,500 patients was potentially cached on the laptop. However, the investigation failed to uncover any evidence that the patient information was actually accessed and/or disclosed in some manner by the thief.

The potential data breach was reported to the OCR in April 2017 and the OCR opened an investigation. After a three-year investigation, the OCC made the following findings:

Lifespan did not implement policies and procedures to encrypt all devices used for work purposes
Lifespan did not implement policies and procedures to track or inventory all devices with access to Lifespan’s computer network or which contain patient information
Lifespan did not have the proper agreements in place between the various Lifespan corporations and affiliates
Because of the foregoing, Lifespan impermissibly disclosed HIPAA-protected patient information

Note the high standard that the OCR imposes on health companies with respect to protecting patient data. The OCR punished the data breach even though the breach was the result of criminal behavior by a third party and even though there was no proof that the data was actually accessed or disclosed. From this it can be seen that, legally, a data breach is akin to strict liability.

In addition to paying the $1.04 million fine, Lifespan agreed to a long list of remediations and changes to its cybersecurity protocols. See consent decree here. Some of the more important agreed-upon remediations related to equipment include the following:

Providing an inventory of all Lifespan devices and equipment that have (i) access to, (ii) can store, (iii) or download (iv) or transmit information contained on the Lifespan computer network including desktop and laptop computers, tablets, mobile telephones, USB drives and medical equipment/devices with computer components
Proof that all devices and equipment have been encrypted
Proof of tracking capabilities have been installed in the event of loss or theft
Evidence of new policies and procedures concerning limitations of what data is and can be accessed by high-risk devices
Proof of the ability to remotely wipe and/or permanently destroy data in the event of loss or theft
Evidence of sufficiently updated measures and protocols for controlling access to various devices
Demonstration of new policies concerning and implementation of employee training with respect to physical security and access protocols

Although the Lifespan case involved patient medical records under HIPAA, the legal and practical lessons are more widely applicable. Companies must protect their customer, patient and employee data and failure to have proper cybersecurity protocols will result in liability even from the theft of one single device. Among the necessary protocols are the encryption of mobile devices and laptops.

The focus on cybersecurity for mobile devices has been heightened by the COVID-19 pandemic. As many employees have been working and will continue to work from remote locations, mobile devices have become a weak link in protecting business, consumer and employee confidential information.

For more information or if you have legal questions about data security, how to respond to data breaches, or about hacking and cybercrime, contact the data security lawyers at Revision Legal at 231-714-0100.