> if I were to lose a system that had PHI on it I would be required to report the breach even if the system had full disk encryption According to the Texas Med

> if I were to lose a system that had PHI on it I would be required to report the breach even if the system had full disk encryption According to the Texas Medical Association[0], > there are only two reasons a lost device may not have to be reported as a breach under the HIPAA Breach Notification Rule: (1) no PHI was on the device, or (2) the PHI is unusable - encrypted with FIPS 140-2 encryption [0] https://www.texmed.org/HIPAALostLaptop/ https://www.texmed.org/HIPAALostLaptop/