Breached data that is encrypted need not be reported under the breach notification rule, but here's why Rainbow Hospice had to issue notifications:
The laptop's hard drive, with protected clinical and financial information on 999 patients, was encrypted, says a spokesperson. Two passwords are needed to use the computer, with one of the passwords decrypting data to make the database accessible. So, encryption is turned off when the laptop is in use, and turns back on when the laptop is closed or shut down.
A nurse was visiting a home that had a "chaotic environment," with the laptop turned on and open when it was stolen. But if the laptop had been turned off when stolen, the data would have been encrypted behind two passwords and notification would not have been necessary.
--Joseph Goedert
Be the first to comment on this post using the section below.