Article
If a laptop walked out of your office today, would it be a breach?
Laptops get left in cars. They get left at the airport, at a kid's ball game, on the roof of the car while somebody's loading groceries. That part you can't do much about.
What you can do something about is what happens next. With the drive encrypted and the key kept somewhere safe, a lost laptop is mostly an equipment problem. Without it, you may be looking at notifying patients and reporting to the government.
What HHS actually says
HHS has a guidance page on what makes protected health information "secured." Electronic PHI counts as unusable to an unauthorized person if it's encrypted in a way consistent with NIST Special Publication 800-111 (NIST's guide to storage encryption on end-user devices), and the key or password that unlocks it hasn't been compromised. HHS also says the decryption keys should be kept on a different device or in a different place from the data they protect. (HHS breach notification guidance)
Why that matters: the breach notification rules are about unsecured PHI. Encryption done right, with the key kept separately, is the difference.
Notice the part about the key. If the BitLocker recovery password is taped to the bottom of the laptop, or saved in a text file on the desktop, the encryption isn't doing you much good.
"Addressable" doesn't mean optional
The HIPAA Security Rule lists encryption as an "addressable" specification. (45 CFR 164.312) It's easy to read that word as "optional." HHS doesn't. In its own FAQ, HHS says an addressable item has to be implemented if your risk assessment finds it's reasonable and appropriate. If you decide it isn't, you have to write down why and put an equivalent alternative in place, when that alternative is reasonable and appropriate. (HHS FAQ: Is the use of encryption mandatory?)
For a laptop that holds patient information and leaves the building, I'd have a hard time writing that "not reasonable" memo with a straight face. BitLocker is already part of Windows Pro and Enterprise.
What it looks like when it isn't there
In February 2017, an employee's car was broken into in a public parking lot and a work laptop was stolen. It wasn't encrypted, and work email cached on it may have exposed patient names, medical record numbers, demographic information and medication names for 20,431 people. In July 2020, Lifespan, the Rhode Island health system that includes the employee's hospital, agreed to pay HHS's Office for Civil Rights $1,040,000 and take on a two-year corrective action plan. OCR's findings included not encrypting devices used for work and not keeping an inventory of devices that touch patient data. (HHS: Lifespan settlement, HIPAA Journal summary)
That's a big health system, not a five-provider practice. But the laptop and the parking lot look the same everywhere.
What I'd check
None of this needs new software. It needs somebody to look.
- Every laptop, first. Is BitLocker actually on, and is the drive fully encrypted? "We turned it on a while back" isn't the same thing.
- Suspended drives. BitLocker gets suspended for things like BIOS and firmware updates. Microsoft says it normally comes back on at the next restart, unless someone set it to stay suspended longer. While it's suspended, the drive is still encrypted but the key is sitting on the disk in the clear. (Microsoft: BitLocker recovery overview, Win32_EncryptableVolume)
- Second drives. A D: drive full of scans or exports doesn't get encrypted just because C: is.
- Recovery keys. Where are they? For domain-joined PCs, Microsoft recommends storing them in Active Directory; for Entra-joined PCs, in Entra ID. Either way, not on the laptop, and not in one person's head.
- The desktops. Front-desk PCs walk off less often, but they get stolen in break-ins and they get recycled. Same check.
- A list. Write down every device that can reach patient data. You can't check what you don't know you have, and the missing inventory was one of OCR's findings in the Lifespan case.
If you want a quick look at one PC, open PowerShell as an administrator and run manage-bde -status. It shows each drive's encryption status, its protection status, and its key protectors. If your PCs are in Intune, its encryption report covers the managed ones.
Want a second set of eyes?
I'm Kevin Roper, and I run Roper IT Consulting out of Holly Springs, NC. I've been in IT for more than 25 years, most of it in healthcare. I do a fixed-price $750 healthcare IT security assessment for small practices and clinics. I'll check your devices, encryption and recovery keys along with backups, accounts and the other common gaps, then give you a plain-English list of what to fix first. I work remotely with practices anywhere, and on-site around Raleigh and Wake County.
If you'd like to set one up, request a consultation at roperitconsulting.com.