The 2017 theft of an unencrypted laptop is at the heart of a new HIPAA settlement^[1] with Lifespan Health System Affiliated Covered Entity (Lifespan ACE) in Rhode Island, which agreed to pay $1.04 million to settle potential violations of the privacy and security rules, OCR said July 27.^[2]

It reinforces the importance of encryption, although generally health care organizations have gotten the message, said Brian Selfridge, a partner in Meditology Services and CORL Technologies. They should be focusing on the security risks posed by business associates and other third parties, which is a growing threat because of the unrelenting outsourcing by health care organizations.

Lifespan ACE includes three academic teaching hospitals—Rhode Island Hospital and its Hasbro Children’s Hospital; The Miriam Hospital; and Bradley Hospital—as well as Newport Hospital and Gateway Healthcare. According to Lifespan ACE’s resolution agreement with OCR on Feb. 25, 2017, a MacBook was stolen from the car of a Rhode Island Hospital employee. Lifespan ACE realized the employee’s work emails possibly were cached in a file on the laptop’s hard drive, and the thief may have had access to patient names, medical record numbers, demographic information and the names of one or more medications that were prescribed to patients. Protected health information (PHI) on the laptop may have included patient information from Rhode Island Hospital, Lifespan Pharmacy LLC, retail pharmacies and affiliated Lifespan ACE hospitals, OCR said.