HLTH 4303 Module 1 HIPAA Privacy Incident Analysis Example

A Tablet Left in a Rideshare: Applying the HIPAA Security and Breach Notification Rules to Thirty-Eight Residents' Assessment Drafts at a Skilled Nursing Facility

Student Name

American College of Education

HLTH4303: Legal and Ethical Issues in Healthcare Administration

Module 1 Assignment

Instructor Name

October 5, 2026

The Incident

On a Thursday evening, the minimum data set coordinator at our composite 120-bed skilled nursing and rehabilitation center left a facility tablet in the back seat of a rideshare car after a training session across town. She reported the loss the next morning. The tablet held draft assessment forms for 38 current residents, including names, dates of birth, Medicare numbers, diagnoses, medication lists and notes on cognition and mood. The tablet required a four-digit passcode to open, but its storage was not encrypted, because the facility's mobile devices had been set up by a vendor who left encryption off to speed up the software. The rideshare company's lost-item process did not recover it.

As assistant administrator, I was asked to lead the facility's response. This paper applies the relevant HIPAA rules to the facts, explains what the facility is required to do and recommends what it should change. A passcode kept the tablet closed to a casual finder; the law asks whether the data inside were protected, and they were not.

Is This Protected Health Information?

HIPAA's Privacy Rule protects individually identifiable health information held by covered entities, which include health care providers that bill electronically, such as our facility. The assessment drafts combine identifiers, names, birth dates and Medicare numbers, with information about each resident's health and care. They are protected health information in electronic form, and because the facility created and held them, the Privacy Rule and the Security Rule both apply.

The Security Rule requires covered entities to protect the confidentiality, integrity and availability of electronic protected health information through administrative, physical and technical safeguards. Encryption is listed as an addressable implementation specification, which means the facility must either implement it or document why an equivalent alternative is reasonable. Our risk analysis from two years ago had identified mobile devices as a risk and recommended encryption, and there is no record of a documented alternative. That gap matters twice: it is a compliance failure in its own right, and it determines whether the loss is a reportable breach.

Is It a Breach?

The Breach Notification Rule starts from a presumption that works against the facility. If protected information goes somewhere the Privacy Rule forbids, the event counts as a breach, and the burden is on the facility to show otherwise through a documented risk assessment concluding that compromise is unlikely (Breach Notification for Unsecured Protected Health Information, 2024). The notification duties reach only unsecured information. Data encrypted to the federal standard fall within a safe harbor, and losing them does not trigger notice.

The rule names four factors for that assessment, and the facts answer each of them badly. The data are sensitive: clinical details plus Medicare numbers that could support identity or billing fraud. The person who now has the tablet is unknown; it passed to a driver and perhaps to later riders. No one can say whether the files were opened, because the tablet was never recovered and had no remote wipe. And the facility has done almost nothing to reduce the risk. With no factor pointing toward a low probability of compromise, the loss must be handled as a reportable breach.

What the Facility Must Do

Because fewer than 500 people were affected, the rule sets out three obligations. Each of the 38 residents, or the resident's personal representative, must receive a written letter no later than 60 days after the loss was discovered, and sooner if possible. The letter has to explain in plain language what was lost, which kinds of information were on the tablet, how residents can guard against misuse, what the facility is doing about it and whom to call with questions. The breach also goes into the facility's breach log, and the year's log is filed with HHS no more than two months into the following year. Notice to the news media applies only when more than 500 residents of one state are affected, which is not the case here. Because state breach laws can add duties, counsel should review ours before letters go out.

The facility should not wait for the deadline. Sixty days is a limit, not a target, and every week of delay is a week in which a resident's Medicare number could be misused without anyone watching for it. The administrator should also document each step of the response, the date of discovery, the risk assessment, the date letters were sent and the log entry, because investigators reviewing a breach look first at whether the facility followed its own procedures on time. Letters should go out within two weeks, and because several residents have cognitive impairment, letters should go to their representatives and be followed by a phone call from the social services director. The facility should also offer credit and Medicare fraud monitoring, since Medicare numbers were exposed.

Why This Keeps Happening

Lost and stolen devices are an old problem, and the national record shows that health data breaches are common and growing. Using the federal breach reporting data, McCoy and Perlis (2018) examined reported health data breaches from 2010 to 2017 and found that breaches increased over the period, with hacking and information technology incidents becoming the largest source of breached records. Loss of devices is less dramatic than a cyberattack, but it is more within a facility's control, because the fix is known and inexpensive.

The 2013 omnibus changes to the HIPAA rules also made clear that the facility answers for the actions of its business associates (Department of Health and Human Services, 2013). The vendor who configured the tablets without encryption is a business associate, and its agreement with the facility requires it to safeguard protected health information. Whether the vendor breached that agreement is a question for counsel, but it does not reduce the facility's own obligations to residents.

Corrective Actions

The facility should take four corrective actions. First, encrypt every laptop, tablet and phone that holds resident information within 30 days, and enable remote wipe, so that a future loss falls within the safe harbor. Second, update the risk analysis and document every addressable specification, recording either implementation or the reasons for an alternative. Third, apply the facility's sanctions policy to the incident consistently; the coordinator reported the loss promptly and followed the policy on taking devices off site, so retraining rather than discipline is appropriate, but the decision should be documented. Fourth, retrain all staff who use mobile devices on the rule that devices holding resident information are never left unattended outside the building.

The administrator should report progress on these actions to the compliance committee monthly until all are complete. A breach that leads to encryption across every device will have cost the facility some trust, but it will prevent the next loss from becoming a breach at all.

References

Breach Notification for Unsecured Protected Health Information, 45 C.F.R. §§ 164.400-164.414 (2024).

Department of Health and Human Services. (2013). Modifications to the HIPAA privacy, security, enforcement, and breach notification rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; other modifications to the HIPAA rules. Federal Register, 78(17), 5566-5702.

McCoy, T. H., Jr., & Perlis, R. H. (2018). Temporal trends and characteristics of reportable health data breaches, 2010-2017. JAMA, 320(12), 1282-1284. https://doi.org/10.1001/jama.2018.9222