3 ms·
I wonder how many of these are encrypted systems. I see a lot of "theft" and "loss" on that list. I know if I were to lose a system that had PHI on it I would b
by telchar 9y ago
I wonder how many of these are encrypted systems. I see a lot of "theft" and "loss" on that list. I know if I were to lose a system that had PHI on it I would be required to report the breach even if the system had full disk encryption. I'd bet many or most of these are similar.
- miles 9y ago> if I were to lose a system that had PHI on it I would be required to report the breach even if the system had full disk encryption According to the Texas Medical Association[0], > there are only two reasons a lost device may not have to be reported as a breach under the HIPAA Breach Notification Rule: (1) no PHI was on the device, or (2) the PHI is unusable - encrypted with FIPS 140-2 encryption [0] https://www.texmed.org/HIPAALostLaptop/ https://www.texmed.org/HIPAALostLaptop/
- olympus 9y agoI’d guess that a lot of the encrypted systems had a password written on a sticky note on the desk or in the laptop bag. Encryption doesn’t do much unless you take the other sensible steps. It’s more worrying to me that a doctor might not report a breach because the data is encrypted, but had the keys stolen along with the computer.