Lost Device Containing Fetal Ultrasound Archives: Incident Response Checklist

A missing laptop, tablet, phone, removable drive, or imaging device that may contain fetal ultrasound archives should be treated as a potential security incident. Report it promptly, contain access where possible, and document what the device could access before deciding whether the HIPAA Breach Notification Rule applies.

HIPAA’s notification requirements generally concern breaches of unsecured protected health information (PHI) held by covered entities and business associates. The steps below are a practical response checklist; follow your organization’s incident-response policy and involve its privacy and security leads.

How should you report and contain a lost device?

Notify your organization’s privacy or security officer and IT or security team immediately, using the incident-reporting channel in your organization’s policy. Provide the time and place the device was last seen, when it was discovered missing, who used it, and whether it was lost or may have been stolen. Do not wait to confirm that PHI was on the device before reporting it.

Give IT the device type, asset tag or serial number, assigned user, and any known connection to ultrasound systems, email, cloud storage, or clinical networks. Ask the security team to suspend accounts or sessions, revoke credentials or tokens where appropriate, and use a remote device wipe if it is available and authorized. Record the actions and their times. HHS’s mobile device security checklist recommends prompt reporting of lost or stolen devices and identifies remote wiping as a protective measure.

Do not attempt to recover, access, or wipe the device yourself unless your organization’s procedures authorize you to do so. Preserve available logs and account records, and coordinate any contact with a finder, law enforcement, or a device-management provider through the incident-response team.

What fetal ultrasound archives and protected health information were stored on it?

Identify what was stored locally and what the device could access remotely. Check for ultrasound images and video, reports, appointment or patient lists, exported files, screenshots, local caches, backups, removable media, and credentials that could open an imaging archive or clinical system.

Determine whether the files or images were linked or reasonably linkable to a patient through names, medical record numbers, dates, facility details, image annotations, or other identifiers. Health information that identifies a person or can reasonably be used to identify them may be PHI when it is held by a HIPAA covered entity or business associate. HHS describes medical records and X-rays among the health information held in designated record sets in its guidance on health information.

Build an initial inventory without copying sensitive files into unapproved locations. Record the affected date range, file types, estimated number of unique patients, identifiers present, and whether the archives included information about the pregnant patient or other identifiable clinical details. Treat the fetal ultrasound images in context: the HIPAA analysis concerns individually identifiable health information about a person, not an assumption that a fetus is separately a HIPAA patient.

How do encryption and device access affect exposure risk?

Find out whether the affected archives were protected by encryption at rest that meets HHS guidance, and whether the confidential decryption key or credentials could also have been exposed. Encryption may mean the information is not “unsecured protected health information” for purposes of the HIPAA Breach Notification Rule when the specified safeguards are effective and the key has not been compromised. See HHS’s guidance on encryption and unsecured PHI.

Do not assume that a device’s encryption setting alone resolves the issue. Determine whether it was powered off, locked, or logged in when lost; whether a strong passcode and access controls were active; whether files were accessible after login; and whether the encryption was actually enabled for the relevant storage. HHS explains that a properly shut-down, powered-off laptop protected by qualifying full-disk encryption may render its PHI unreadable, while data accessed after the device is unlocked may be exposed. See the HHS Ransomware and HIPAA fact sheet.

A successful remote wipe may reduce ongoing exposure, but document when it was initiated and whether it was confirmed. A wipe does not by itself establish whether information was previously accessed or whether the device met the encryption safe-harbor conditions.

How should you assess whether a breach occurred?

First determine whether the incident involved an impermissible access, use, or disclosure of PHI and whether that PHI was unsecured. If unsecured PHI may have been involved, an impermissible disclosure is generally presumed to be a breach unless an applicable exception applies or the covered entity or business associate documents a breach risk assessment showing a low probability that the PHI was compromised. HHS describes the rule and assessment factors in its HIPAA Breach Notification Rule guidance.

Evaluate at least these four factors:

• Nature and extent of the PHI: What identifiers and clinical details were present, and how readily could the patients be identified?
• Who may have received or accessed it: Was the device likely lost in a controlled setting, or could an unauthorized person have obtained it?
• Whether PHI was actually acquired or viewed: Consider device and application logs, login activity, file-access records, and credible witness information.
• Mitigation: What steps reduced the risk, such as account suspension, confirmed remote wipe, recovery of the device, or assurances that information was not retained?

Document the evidence and reasoning for each factor, including uncertainties and follow-up steps. A missing device is not automatically a reportable breach in every circumstance; the decision depends on the facts, the encryption status, whether an exception applies, and the documented assessment.

What HIPAA notifications may be required and by when?

If the incident is a breach of unsecured PHI, a covered entity generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. A breach affecting 500 or more individuals also requires notice to the HHS Secretary within that period and notice to prominent media outlets serving a state or jurisdiction if more than 500 residents of that state or jurisdiction are affected. For a breach affecting fewer than 500 individuals, the covered entity must report to the Secretary no later than 60 days after the end of the calendar year in which the breach was discovered. See HHS’s notification requirements.

If a business associate discovers a breach of unsecured PHI, it must notify the covered entity without unreasonable delay and no later than 60 days after discovery; the business associate agreement may require a shorter reporting period. This covered entity notification is not the same as notifying affected individuals. Coordinate the response with the covered entity and follow the agreement’s reporting terms.

Where notice to individuals is required, the notice must include information specified by the rule, such as a description of what happened and the types of information involved, steps individuals can take, and how the organization is investigating and mitigating the incident. Coordinate final determinations and notices with the privacy officer and legal counsel; other laws or contractual requirements may also apply.

What records should you preserve during the investigation?

Keep a dated incident file that allows the organization to reconstruct what happened and support its decision. Preserve, as applicable:

• The initial report, discovery time, incident timeline, device identifiers, assigned user, and circumstances of loss.
• Inventory of potentially affected archives, systems, patients, data types, identifiers, and the method used to estimate the number of individuals.
• Evidence of encryption settings, device lock and power state if known, access controls, key management, logs, account activity, and relevant system alerts.
• Containment and mitigation actions, including account or credential changes, remote-wipe requests and confirmation, recovery efforts, and communications with vendors or law enforcement.
• The written breach risk assessment, evidence reviewed, applicable exceptions considered, decision on whether notification is required, and approvals or consultations.
• Copies of any notifications sent, evidence of required reporting, and records showing why notification was not required if that is the conclusion.

HHS says covered entities and business associates must be able to demonstrate that required notifications were made or that notification was not required, such as through a documented low-probability risk assessment or an applicable exception. The Security Rule requires covered entities and business associates to retain required HIPAA documentation for at least six years from its creation or the date it was last in effect, whichever is later; state law or organizational policy may require longer retention. See HHS’s Security Rule summary and Breach Notification Rule guidance. This is a documentation retention rule, not a universal HIPAA requirement to retain every medical record for six years.

In short, report the loss promptly, establish what identifiable ultrasound information and access paths were involved, verify encryption and mitigation, document the breach risk assessment, and meet any applicable notification deadlines.

FAQs

How soon should a lost device containing fetal ultrasound archives be reported?

Report it immediately under your organization’s incident-response policy. Prompt reporting gives IT and security teams a chance to suspend access, initiate an authorized remote wipe, preserve relevant logs, and begin assessing whether PHI was involved. The HIPAA notification deadline is a separate question that depends on whether a breach of unsecured PHI occurred.

Does encryption change whether notification is required?

It can. If PHI was encrypted in accordance with HHS guidance and the decryption key was not compromised, it may not be unsecured PHI subject to HIPAA breach notification. Confirm that encryption applied to the affected files in the device’s actual state; do not rely only on a general device setting. If PHI was unsecured, assess the facts and document whether the risk assessment supports a low probability of compromise.

When must affected individuals be notified under HIPAA?

When a covered entity determines that a breach of unsecured PHI occurred, it must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Other deadlines apply to notice to HHS and, in specified circumstances, the media. HHS’s Breach Notification Rule guidance explains those requirements.

What records should be kept if notification is not required?

Keep the incident timeline, data and patient inventory, encryption and access evidence, mitigation records, and the written reasoning for the decision. If the decision relies on a low probability of compromise, preserve the documented assessment of the four required factors; if it relies on an exception, document the facts supporting that exception. Retain required HIPAA documentation for at least six years from creation or the date it was last in effect, whichever is later, and check whether other requirements call for longer retention.