Incident Response Playbook for a Stolen Clinic Tablet with Cached Patient Lists

This incident response playbook gives you a precise, action-first path to contain risk, verify Patient Data Exposure, and meet Regulatory Compliance obligations after a clinic tablet goes missing. It balances rapid technical controls, clear decision points, and disciplined Incident Documentation so you can protect patients and the organization.

Initial Assessment

What to verify in the first hour

• Establish facts: who last used the tablet, when it was noticed missing, asset tag/serial, make/OS, and assigned user or department.
• Check management consoles (MDM/EMM/IdP/EHR): last check-in time, network location, installed apps, compliance status, and active sessions.
• Confirm security posture: full‑disk encryption enabled, strong passcode/biometric, lock screen protections, and whether notifications can display PHI.
• Identify cached data: which EHR/scheduling apps store offline patient lists, the cache duration, and whether app-level encryption is enabled.
• Open an incident record, assign an incident lead, and alert privacy/security leadership and legal counsel.

Assess likelihood of Patient Data Exposure

• Nature of data: names, dates of birth, MRNs, appointment times, diagnoses, or payment data cached on the device.
• Unauthorized recipient: theft context (crime of opportunity vs. targeted theft) and likelihood of technical skill to bypass controls.
• Acquisition/viewing indicators: failed unlock attempts, new logins, app syncs, or API calls from the device after loss.
• Mitigation effectiveness: speed of Remote Device Wipe or lock and revocation of tokens and sessions.

Preserve evidence and coordination

• Preserve MDM, EHR, IdP, VPN, and network logs; snapshot device details in management portals before issuing destructive commands.
• File a police report to document the theft and obtain a case number for downstream reporting.
• Communicate internally with need-to-know teams only; maintain a single source of truth in the incident record.

Containment Strategies

Immediate device controls

• Place the tablet in lost mode, enable remote lock, set a contact message, and attempt location if legally permissible.
• Execute Remote Device Wipe as soon as recovery is unlikely or PHI risk is material; record the command time and confirmation.
• Disable push notifications that could reveal PHI on the lock screen and pause any background data refresh for affected apps.
• Block the device’s hardware identifier in MDM and, if applicable, request carrier IMEI/SIM blocking.

Access Credential Revocation

• Immediately revoke OAuth/SSO refresh tokens, device certificates, and EHR mobile app registrations tied to the tablet.
• Force password resets and re-enrollment in MFA for the assigned user and any shared clinical accounts used on the device.
• Terminate active sessions across email, messaging, file sync, and EHR portals; invalidate API keys or mobile app secrets if applicable.

Compensating controls while missing

• Tighten conditional access for all mobile devices (require compliant, encrypted, and healthy state before app access).
• Temporarily restrict offline caching of patient lists or reduce cache TTL for all users until the incident is resolved.
• Increase monitoring thresholds for anomalous logins and data access related to the affected user and department.

Eradication Procedures

Threat Eradication actions

• Rotate mobile app signing secrets, device trust certificates, and any shared credentials that could be reused by the thief.
• Delete the device object from all identity and EHR allowlists; confirm no lingering push tokens or app registrations remain.
• Audit third-party integrations for stale tokens and revoke or rotate them to close indirect access paths.

Hardening to eliminate recurrence

• Enforce stronger passcodes, automatic lock at short intervals, and verified full‑disk encryption on all clinic tablets.
• Mandate app-level encryption, purge-on-failed-unlock thresholds, and “no PHI on notifications.”
• Standardize kiosk/work-profile deployments that separate clinical apps from general use and support remote selective wipe.

Recovery Plan

Replace and re-enroll securely

• Provision a new clinic-owned tablet via zero‑touch enrollment; auto-install only approved clinical apps and profiles.
• Re-enable required EHR mobile access with least-privilege roles and policy-based offline data limits.
• Validate sign-out everywhere: confirm the stolen device cannot resync or receive push notifications.

Operational recovery and monitoring

• Restore clinical workflows and verify that on-call/rounding teams have current patient lists via secure channels.
• Implement heightened monitoring for 30–90 days: look for credential stuffing, unusual device registrations, or bulk record access.
• Brief staff on revised handling procedures and reinforce device custody expectations.

Notification Requirements

Decide if Data Breach Notification is required

Work with your privacy officer and counsel to determine if this event constitutes a breach of unsecured PHI. Use a documented risk assessment that considers the nature of PHI, the unauthorized recipient, evidence of acquisition or viewing, and the effectiveness of mitigation (e.g., timely wipe and Access Credential Revocation). If PHI was encrypted and the key was not compromised, notification may not be required; document the rationale either way for Regulatory Compliance.

Who to notify and when

• Individuals: notify without unreasonable delay and within the maximum time allowed by law; include plain-language guidance and protections offered.
• Regulators: follow federal rules for breaches of PHI and any applicable state timelines; larger incidents may also require media notice.
• Business associates or covered entities: coordinate if responsibilities are shared by contract.

What to include in notices

• What happened, when it occurred, and when it was discovered.
• What information was involved and the likelihood of Patient Data Exposure.
• What you have done (e.g., Remote Device Wipe, Threat Eradication, monitoring) and what you are offering to affected individuals.
• What patients can do next and how to reach your incident hotline or privacy office.

Documentation Process

What to capture for Incident Documentation

• Chronology: detection, containment, eradication, recovery, and notification timestamps with responsible parties.
• Technical evidence: MDM/IdP/EHR logs, wipe confirmations, token revocations, configuration snapshots, and access reports.
• Decision records: risk assessment inputs, notification determinations, legal consultations, and executive approvals.
• Communications: stakeholder updates, patient letters/templates, regulator submissions, and media statements.
• Retention: store all records securely for required periods (e.g., at least six years for HIPAA-relevant documentation).

Lessons learned and corrective actions

• Root causes: gaps in custody, caching policies, authentication, or training.
• Corrective actions: stronger policies, revised MDM baselines, reduced offline data, and improved check‑in frequency.
• Preventive measures: recurring tabletop exercises, surprise audits of device controls, and staff education.

Conclusion

By moving quickly through assessment, decisive containment, and Threat Eradication, you limit harm and maintain trust. A disciplined Recovery Plan and complete Incident Documentation ensure Regulatory Compliance while strengthening your readiness for future events.

FAQs

How do you confirm patient data exposure after a tablet theft?

Correlate MDM and EHR logs for activity after the loss, including app launches, syncs, or API calls. Review lock and encryption status, notification settings, and failed unlock attempts. Interview users about what was cached (e.g., patient lists) and run targeted EHR audits for those records. Combine these inputs in a documented risk assessment to determine the likelihood of Patient Data Exposure.

What are the best practices for remote wiping a stolen device?

Issue the Remote Device Wipe as soon as recovery is unlikely or PHI risk is nontrivial. Capture pre-wipe evidence (screenshots of device status), then execute a full wipe with account/token revocation. Confirm wipe completion, remove the device from all allowlists, and monitor for any post-wipe activity. Prefer supervised/managed deployments so wipes are reliable and verifiable.

When should patients be notified about a data breach?

Notify patients without unreasonable delay once you determine a qualifying breach, and within legally mandated timelines. Base the decision on your risk assessment, considering what PHI was involved and whether effective mitigation (like immediate wipe and Access Credential Revocation) occurred. Coordinate with your privacy officer and legal counsel to ensure the notice content and timing meet all Regulatory Compliance obligations.