"Fool me once, shame on you…fool me twice, shame on me…"
The same organization, Providence Health System, who had a laptop containing patient information stolen from an employee’s car in January (see my January 27 blog posting) has experienced laptop thefts not just once more, but twice more…each from cars AGAIN! "The stolen laptops were being used by home care and hospice nurses to chart records on the patients they visit each day." On February 27 and March 3 laptops were stolen from the cars of the home care nurses; one as the worker ran into a store quick and left the laptop in the car, and the other laptop was stolen from the worker’s car while the worker was visiting a home patient.
I wrote about the unwise practice of using Lexus laptop lockers in the March Computer Security Institute Alert newsletter.
"Many patients are backing a class-action lawsuit against Providence. So far, none of the stolen records appears to have been exploited by criminals." Smart thieves will likely wait to do much obvious mischief with the stolen information. There is also the possibility that the information is being used in unsavory ways that won’t show up in a credit monitoring report…privacy is about more than just identity theft. And, of course, perhaps the thieves will sell the laptops on eBay to make a little extra pocket money…hmm…something to keep an eye out for.
Two laptops containing clear text patient information were also stolen from Providence last year; the company indicates they are taking a "deeper" look at those thefts.
After the January incident involving information about 365,000 patients, Providence indicated they had paid up to $9 million for credit monitoring…after pressure from the impacted individuals.
"Since the thefts..the company has begun adding encryption to home-care practitioners’ laptops to lock out unauthorized users." This was done after the thefts this week.
I’m sure the encryption solution cost much less than $9 million.
With all these reported incidents of stolen laptops, thieves are probably on the lookout more than ever for vulnerable laptops and other mobile computing devices. I hope this is a bellwether for companies to start encrypting data on these devices as a matter of standard business practice and due care.
Technorati Tags
privacy
stolen laptop
HIPAA
laptop theft
patient privacy
HIPAA compliance
HIPAA violation