October 13, 2026
This story is fictional. If it sounds like your health system, that’s between you and your privacy officer.
I had been the privacy officer for four days when Howard drove me out to the clinic at the county line to see what he called the server closet and what turned out to be a closet. Howard has run IT for the system for twenty-two years. He drives with both hands on the wheel and does not play the radio.
I had spent those four days reading binders. The last risk analysis anyone had done was six years old, and I had brought it along to have something to talk about. Most of it was fine. Under Portable devices someone had written Encryption: TBD — H.M.
I asked him who H.M. was, although I knew.
“That’s me,” Howard said. “That’s the laptop.”
We were passing soybeans, then corn, then soybeans again, like a green ocean undulating toward the horizon. I waited.
“Clinic manager out here had a laptop for the billing. Had a spreadsheet on it with every patient they’d seen in three years. Names, birth dates, insurance numbers, what they were in for. One night he stops at the Y on the way home to swim laps, leaves it in the trunk. Somebody broke the window. They took the laptop and a gym bag, and they left the spare tire.”
“Did the police find it?”
“Police took a report. We sent letters to everybody on the spreadsheet. The paper ran it on page three, under a story about a bake sale.” He was quiet for a while. “It wasn’t encrypted. That was on the list. You saw the list.”
“I saw it.”
“We had an agent on it, though. Inventory software. It can’t erase anything, it just reports in, tells us where it is. Every so often it still checks in.” He said it the way he might have said the furnace still came on. “A truck stop in Oklahoma, once. A community college in Iowa. Two Christmases ago it was the Catholic church in town, three in the morning. Their Wi-Fi doesn’t have a password.”
“Couldn’t the police go and get it?”
“By the time anybody looks, it’s gone again. And they were never all that interested. It’s a laptop.”
I said something about how the clinic manager must have felt.
“I wouldn’t know,” Howard said. “It was my car. I was covering out here that month.”
At the stoplight by the hospital he took out his phone, opened something, and handed it to me. It was a list of devices, all green but one. The gray one had a name that was only a string of numbers, and beside it the words Last check-in: today, 6:12 a.m. The location was the public library on Elm Street, across the road from where we were stopped.
“It doesn’t open until nine,” I said.
“No,” Howard said. The light changed, and he drove on.
Before you read on: Was encryption optional? What does the “TBD” say about the risk analysis? Does the check-in change anything?
Encryption of stored data is an addressable specification under the Security Rule (45 C.F.R. § 164.312(a)(2)(iv)). A covered entity must implement an addressable specification if it is reasonable and appropriate, or document why it is not and adopt an equivalent measure (§ 164.306(d)(3)). Howard’s “TBD” left the question open for six years. The risk analysis required by § 164.308(a)(1)(ii)(A) identified the risk correctly, and then nobody did the risk management that § 164.308(a)(1)(ii)(B) requires.
Encryption also determines whether a theft requires notification. PHI encrypted in line with HHS guidance on rendering PHI unusable (which points to NIST SP 800-111 for data at rest) is not “unsecured,” so losing it triggers no notification. An unencrypted laptop that is never recovered triggers all of it: letters to every patient, media notice if more than 500 residents of a state are affected, and notice to the Secretary (§§ 164.404–164.408). In July 2020 Lifespan paid $1,040,000 after an employee’s unencrypted laptop was stolen from a car in a parking lot and never recovered, exposing PHI for 20,431 people. OCR found that Lifespan had no policy to encrypt every device used for work.
Because the letters went out years ago, the check-ins have no legal effect, but they undercut the comfortable assumption that the thief wiped the drive and sold the hardware. Howard’s agent could locate the laptop but not erase it, so it tracked the machine without protecting anything on it. A remote-wipe tool helps, but only when the device goes online, so it supplements encryption and never replaces it.
To prevent a repeat, enforce full-disk encryption through device management on every laptop before it is issued, and confirm it with a monthly compliance report. Keep PHI off local drives wherever the work allows. Give every risk-analysis finding an owner and a date.
Takeaway: Encrypt every laptop before it leaves the building, because a stolen encrypted laptop is only lost hardware.