Incident Response Guide: Unencrypted USB Drive at a 24/7 Nurse Triage Service

Report and Contain the Missing USB Drive

Start the response as soon as you discover the USB drive is missing. Record when and where it was last seen, who used it, when the loss was discovered, and what steps have already been taken. Notify your privacy or security officer and follow your organization’s incident-response process.

Because a nurse triage service operates around the clock, make the report available to every shift and assign a single response lead. Ask staff to check the workstation, storage areas, transport bags, and locations visited during the relevant shifts. Preserve access logs, device inventories, security footage, and other relevant records rather than altering or deleting them.

Limit any further exposure. If the drive may contain credentials, tokens, or other access information, revoke or reset them. Check whether the device-management system can locate or remotely disable the drive, but do not assume that a remote-wipe command worked unless you can confirm it. Continue triage through approved systems and devices so patient care is not disrupted.

Identify Data and Potential Exposure

Determine what the drive contained by reviewing authorized inventories, backup records, file-transfer logs, and the employee’s account of how it was used. Avoid creating additional copies of protected health information (PHI) unless necessary for the investigation, and restrict access to anyone who needs the information to respond.

Identify the files and data fields involved, the patients or callers represented, and the date range covered. Nurse triage records may include names, contact details, symptoms, medical histories, call notes, and recommendations. Document whether the drive held complete records or limited extracts, and whether any non-PHI information was also present.

Establish whether the device was truly unencrypted, whether individual files were separately protected, and whether any passwords or decryption keys were stored with it. Also check for evidence that the drive was recovered, accessed, copied, or connected to another device. Keep a record of what you know, what remains uncertain, and how each finding was verified.

Assess the HIPAA Breach

The HIPAA Breach Notification Rule applies to breaches of unsecured PHI. An impermissible use or disclosure of PHI is generally presumed to be a breach unless the covered entity or business associate can demonstrate, through a breach risk assessment, that there is a low probability the PHI was compromised. An unencrypted drive containing PHI does not qualify for the encryption safe harbor; however, the circumstances still need to be assessed before deciding whether notification is required.

Determine whether your organization is the covered entity responsible for notification or a business associate required to notify the covered entity. If a business associate handled the drive, review the applicable agreement and promptly coordinate with the covered entity. Do not delay escalation while the parties decide who will lead the investigation.

Record the decision, the evidence considered, and the reasoning behind it. If the organization cannot demonstrate a low probability of compromise, treat the incident as a breach of unsecured PHI and proceed with the applicable notification steps.

Evaluate Risk Factors and Mitigation

Your breach risk assessment must consider at least four factors: the nature and extent of the PHI, including identifiers and the likelihood of re-identification; who used or received the PHI without authorization; whether the PHI was actually acquired or viewed; and the extent to which the risk was mitigated. Consider the facts together rather than relying on a single factor, such as the absence of evidence that someone opened a file.

• Nature and extent: Assess how sensitive and detailed the records are, which identifiers are present, and whether the information could be linked to specific patients.
• Unauthorized person: Determine who may have found or accessed the drive, whether that person was authorized to handle PHI, and what evidence supports that assessment.
• Acquisition or viewing: Review available logs, device activity, file-access records, and recovery information. State clearly when the evidence cannot establish whether the files were viewed or copied.
• Mitigation: Document actions such as recovering the drive, disabling access, revoking exposed credentials, or obtaining credible confirmation that the information was not retained or further disclosed.

Explain how each finding affects the likelihood of compromise. If important facts remain unknown, describe the uncertainty and why the available evidence does or does not support a low-probability determination.

Meet HIPAA Breach Notification Deadlines

If the incident is a reportable breach, affected individuals must be notified without unreasonable delay and no later than 60 calendar days after discovery. The deadline is a maximum, not a reason to wait until the final day. For a breach affecting 500 or more individuals, the covered entity must also notify the Secretary of the U.S. Department of Health and Human Services without unreasonable delay and no later than 60 calendar days after discovery. Media notification is also required when the breach affects more than 500 residents of a state or jurisdiction.

For a breach affecting fewer than 500 individuals, the covered entity may submit the report to HHS annually, but it must do so within 60 days after the end of the calendar year in which the breach was discovered. The organization may report earlier; it does not have to wait until year-end. Keep individual notification on its separate, faster timeline.

If your organization is a business associate, notify the covered entity as soon as possible under the applicable agreement and HIPAA requirements so it can meet its obligations. Track the discovery date, affected-person count, notification decisions, and the owner responsible for each deadline.

Document the Incident and Strengthen Removable-Media Controls

Maintain a complete incident file: the timeline, reports and interviews, device and data inventories, evidence reviewed, risk assessment, containment and mitigation actions, notification decisions, and copies of any notices. Include who made each decision and when. If the investigation changes the affected-person count or adds relevant facts, update the record and assess whether further action is needed.

Prevent recurrence by limiting removable-media use to approved business needs. Require organization-managed, encrypted devices; maintain an inventory and assignment record; restrict copying of PHI; and use safeguards such as access controls, endpoint monitoring, and secure storage. Train staff to report missing devices immediately and include lost-media scenarios in incident-response exercises.

For a 24/7 service, make sure every shift knows how to report an incident, who is on call, and how to preserve safe triage operations while the response team investigates. In summary, promptly contain the loss, establish what PHI may be involved, document the breach risk assessment, meet any applicable notification deadlines, and reinforce removable-media safeguards.

FAQs

Does an unencrypted USB drive containing PHI qualify for the HIPAA encryption safe harbor?

No. The encryption safe harbor applies when PHI has been rendered unreadable, unusable, or indecipherable to unauthorized people using encryption methods consistent with HHS guidance. PHI on an unencrypted drive is unsecured PHI, so assess the incident under the Breach Notification Rule rather than assuming the safe harbor applies.

What factors determine whether PHI on a missing USB drive was compromised?

Consider the nature and extent of the PHI, who may have received or used it without authorization, whether it was actually acquired or viewed, and what steps were taken to mitigate the risk. Document the evidence and uncertainty for each factor, then determine whether the organization can demonstrate a low probability that the PHI was compromised.

When must affected individuals be notified of a breach?

When notification is required, the covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach.

How are breaches affecting fewer than 500 people reported to HHS?

The covered entity must report each breach to HHS no later than 60 days after the end of the calendar year in which it was discovered. It may submit the report earlier and should maintain records of the breach and its notification decisions.