Lost or Stolen Device? HIPAA Incident Response Steps

Lost or Stolen Device? HIPAA Incident Response Steps

If a laptop, phone, or USB drive containing patient information just went missing, you have a narrow window to respond correctly. The first 24 to 72 hours determine whether this stays a manageable internal incident or becomes a reportable breach with notification obligations, HHS involvement, and potentially significant fines. This guide walks you through the steps in order, explains the encryption safe harbor that may eliminate your reporting obligation entirely, and covers what you need to document along the way.

One important note before diving in: a lost or stolen device is not automatically a HIPAA breach. Whether it becomes one depends on a specific risk assessment your team must complete. That assessment — and how you document it — is the difference between an incident that stays in your files and one that ends up on HHS's public breach portal.