Hacker News Reader

I wonder how many of these are encrypted systems. I see a lot of "theft" and "loss" on that list. I know if I were to lose a system that had PHI on it I would be required to report the breach even if the system had full disk encryption. I'd bet many or most of these are similar.

View on HN

> if I were to lose a system that had PHI on it I would be required to report the breach even if the system had full disk encryption

According to the Texas Medical Association[0],

> there are only two reasons a lost device may not have to be reported as a breach under the HIPAA Breach Notification Rule: (1) no PHI was on the device, or (2) the PHI is unusable - encrypted with FIPS 140-2 encryption

[0] https://www.texmed.org/HIPAALostLaptop/

I’d guess that a lot of the encrypted systems had a password written on a sticky note on the desk or in the laptop bag. Encryption doesn’t do much unless you take the other sensible steps.

It’s more worrying to me that a doctor might not report a breach because the data is encrypted, but had the keys stolen along with the computer.

Reply on news.ycombinator.com