{"id":3041,"date":"2020-08-04T09:35:55","date_gmt":"2020-08-04T09:35:55","guid":{"rendered":"https:\/\/www.empowerelearning.com\/blog\/?p=3041"},"modified":"2020-08-04T09:35:55","modified_gmt":"2020-08-04T09:35:55","slug":"why-you-need-to-encrypt-your-devices-unencrypted-laptop-costs-more-than-1-million-to-a-healthcare-provider","status":"publish","type":"post","link":"https:\/\/www.empowerelearning.com\/blog\/why-you-need-to-encrypt-your-devices-unencrypted-laptop-costs-more-than-1-million-to-a-healthcare-provider\/","title":{"rendered":"Why you need to encrypt your devices – Unencrypted laptop costs more than $1 million to a healthcare provider"},"content":{"rendered":"

Beware if you\u2019re using laptops, tablets and mobile phones for work purposes. You must encrypt your devices for complying with HIPAA rules. Using unencrypted laptops and other mobile devices is considered unsafe. If such a device is stolen, you could risk the privacy and security of patient information.\u00a0<\/span><\/p>\n

Such negligence has cost Lifespan a penalty of more than $1 million. Lifespan also has to take part in a corrective action plan monitored by the Health and Human Services (HHS). The compliance term would last for two years.<\/span><\/p>\n

Unencrypted laptop costs $1 million to a healthcare provider<\/b><\/h2>\n

On July 27, the HHS slapped a <\/span>penalty of $1,040,000<\/span><\/a> on Lifespan ACE for neglecting HIPAA privacy and security rules. This fine is a result of an OCR investigation into a 2017 laptop theft. The theft exposed the data of 20,431 patients. It\u2019s the largest HIPAA enforcement action in 2020.<\/span><\/p>\n

On February 25, 2017 thieves broke into the car of a Lifespan employee and stole many items. One of the stolen items was a MacBook laptop that the employee used for work purposes. The laptop had protected health information of Lifespan patients. It was never recovered. Lifespan filed a breach report with OCR about the theft on April 21, 2017.\u00a0<\/span><\/p>\n

As per Lifespan, they took prompt action to secure the employees email account by changing employee\u2019s login details. But, Lifespan also confirmed that the employee\u2019s work emails may have been cached in a file on the laptop\u2019s hard drive.\u00a0<\/span><\/p>\n

The laptop wasn\u2019t encrypted, and no password was required to access the device. Thieves had access to information, such as patient names, medical record numbers, and their medication records. Stolen information may have included the information for patients across various affiliated entities of Lifespan.\u00a0<\/span><\/p>\n

The HHS investigation uncovered systematic non-compliance of <\/span>HIPAA Rules<\/span><\/a> by Lifespan. The non-compliant behavior included \u2013\u00a0<\/span><\/p>\n