The laptop in question was password protected, but not encrypted and therefore, did not fall within the safe harbor for breach notification. The laptop contained the names, Social Security numbers and medical information of patients and participants in research projects. It was stolen out of an employee’s car. The OCR noted that the security measures and policies and procedures of The Feinstein Institute did not address removable media, such as laptops.
This case is another example of the importance of security measures related to removable media and implementation of encryption technology as a potential risk management tool.