Lost Device Incident Response Checklist for Research Participant Registries

Who should be notified when a registry device is lost or stolen?

Report the loss as soon as you discover it. Use your institution’s institutional incident reporting protocol; don’t wait until you know whether participant data was exposed. Fast reporting gives the response team time to lock accounts, preserve records, and assess risk.

• Notify the principal investigator or study lead and your institution’s IT security or incident-response team.
• Contact the privacy officer and, as your institutional policy requires, research compliance or the IRB office.
• Tell the study sponsor, coordinating center, or device-management provider when the protocol, contract, or institutional procedure calls for it.
• If the device appears to have been stolen, follow institutional procedures for contacting campus security or law enforcement.

If a business associate’s device may hold protected health information (PHI), the business associate should promptly notify the covered entity according to the business associate agreement and applicable requirements. HIPAA requires covered entities and business associates to have procedures for responding to security incidents; those procedures should identify who to contact and how incidents are documented. See HHS guidance on HIPAA security incident procedures.

Do not assume every participant registry or research record is subject to HIPAA. Ask your privacy officer to determine which laws, institutional policies, consent commitments, and contracts apply. Participants are not automatically notified the moment a device is lost; the institution should decide whether notice is required after assessing the incident.

How can you contain risk and locate or secure the device?

Start containment while the institution’s security team investigates whether the device can be located. Record the device type, asset tag or serial number, assigned user, last known location, and time it was last seen. Check approved device-management and location tools, but follow institutional privacy and security rules when using them.

• Use authorized remote lock and wipe controls to lock the device, revoke access, or erase data when directed by the response team.
• Disable or reset credentials that could provide access to registry systems, email, cloud storage, or remote connections. Revoke active sessions and tokens where possible.
• Secure linked accounts and review whether any other devices or applications could still access the same records.
• Preserve available security and access logs before actions that could remove evidence, if doing so will not delay urgent containment.

Coordinate any remote wipe with IT security or the authorized device administrator. Wiping can reduce the chance of unauthorized access, but it may also remove evidence that helps determine what happened. If the device is still at risk of being accessed, don’t delay protective action solely to recover it or complete an investigation.

How should you assess participant data exposure?

Conduct a protected health information exposure assessment based on what was stored on the device and what someone could access through it. Check for downloaded registry files, participant contact details, study notes, coded data, linkage keys, saved passwords, app caches, email attachments, and synced or offline copies.

Establish the device encryption status: whether encryption was enabled, whether it met applicable security guidance, whether the device was powered on or unlocked when lost, and whether the encryption key or credentials may also have been exposed. HHS explains that PHI encrypted in accordance with its guidance, with the decryption key not compromised, may be treated as secured; simply describing a device as “encrypted” is not enough to settle the question. Review HHS guidance on encryption and secured PHI.

If HIPAA applies and an impermissible use or disclosure of unsecured PHI may have occurred, the covered entity or business associate should complete the required breach risk assessment. HIPAA identifies factors that include the nature and extent of the PHI and its identifiers, who received or could access it, whether it was actually acquired or viewed, and how effectively the risk was mitigated. A lost device does not, by itself, prove that data was accessed—or determine whether notification is required. See the HHS HIPAA Breach Notification Rule overview.

Consider whether participant identities could be inferred from coded records, whether the device had an active session, and whether logs show unusual access. Capture uncertainty as well as confirmed facts; do not treat an absence of log entries as proof that no access occurred.

What incident details and response actions should you document?

Create a clear, factual record as events unfold. Follow your institution’s reporting form and procedures; there is no single universal incident-report template for every research registry. For covered entities and business associates, HIPAA security incident procedures include responding to incidents, mitigating harmful effects where practicable, and documenting incidents and their outcomes.

• Incident basics: when and where the device was last seen, when the loss was discovered and reported, its type and asset identifier, and who had custody of it.
• Data and safeguards: the systems and participant information that may have been accessible, encryption and screen-lock settings, authentication controls, and whether credentials or keys could also be exposed.
• Response timeline: whom you notified, when accounts were disabled, which remote lock or wipe actions were taken, and when the device was located or recovered, if applicable.
• Assessment and decisions: what logs and other evidence were reviewed, what remains unknown, how exposure was evaluated, and why notification was or was not recommended.
• Follow-up: corrective steps, participant or regulatory communications made by authorized officials, and any remaining actions or assigned owners.

Preserve relevant access logs and investigation records in approved systems, limiting access to people who need them to respond. Avoid putting additional participant identifiers in general-purpose emails or incident channels. HHS describes incident response, mitigation, and documentation as elements of HIPAA security incident procedures in its guidance for covered entities.

Which IRB and privacy notifications may be required?

Contact the IRB or research compliance office according to institutional policy and the study’s reporting procedures. For research covered by the Common Rule, institutions must have written procedures for prompt reporting of certain events, including unanticipated problems involving risks to participants or others, serious or continuing noncompliance, and suspension or termination of IRB approval. A lost device is not automatically an IRB-reportable unanticipated problem; the institution must assess the circumstances and apply its procedures. The OHRP guidance on reporting incidents explains that the Common Rule uses a “prompt” reporting standard rather than setting one general number of days for these reports.

For HIPAA-regulated entities, notification duties depend on whether the incident involved a breach of unsecured PHI and on the applicable rules and assessment. When HIPAA breach notification is required, a covered entity generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. It must also notify HHS; additional media notice may apply in certain cases. A business associate must notify the covered entity, subject to the applicable requirements and its agreement. See the current regulation on notification to individuals and HHS breach notification guidance.

Coordinate decisions about participant, sponsor, IRB, agency, or other notices with the institutional privacy officer and authorized research officials. Separate internal incident reporting from external breach notification: promptly report the loss internally, then let the responsible officials determine which external notifications apply under law, protocol, policy, and contract.

How should you recover data and follow up with participants?

Restore registry records from a verified, authorized backup or the system of record, then check data integrity and reconcile any work that may have been stored only on the missing device. Keep the lost device blocked from institutional accounts even if it is later recovered until IT security has checked it and approved its return to service.

Resume data collection only on an institution-approved device with required access controls and participant confidentiality safeguards. Review whether the incident points to a need for stronger device encryption, shorter session timeouts, reduced local storage, improved device tracking, or clearer staff procedures. Assign owners and deadlines for agreed corrective actions.

If participant notification is required or otherwise approved by the institution, use plain language. Explain what happened, what kinds of information were involved, what steps the institution has taken, what participants can do, and whom they can contact with questions. HIPAA’s individual-notice rule specifies plain-language content for covered entities that must provide notice; the institution should determine who is authorized to send it and whether additional study-specific communication is appropriate. See 45 CFR § 164.404.

A reliable response starts with immediate internal reporting, then combines containment, a documented exposure assessment, and notification decisions made by the appropriate institutional officials. Recover data from approved sources and use the findings to strengthen safeguards for the registry and its participants.

FAQs

How quickly should a lost research device be reported?

Report it immediately through your institution’s incident process, even if you do not yet know whether participant data was exposed. For certain Common Rule research incidents, federal regulations require prompt reporting under institutional procedures; they do not set one general number of days for every reportable event. HIPAA’s 60-day limit applies to certain required breach notifications after discovery—not to waiting before reporting a lost device internally.

What should an incident report include?

Include when and where the device was lost, when it was discovered and reported, its identifier and custodian, the data and systems it could access, encryption and access controls, containment actions, relevant log findings, notifications, and unresolved questions. Record decisions and follow-up actions with dates and responsible owners, and use your institution’s reporting form.

When should a lost device be remotely wiped?

Use remote wipe when an authorized security or device-management official determines it is appropriate to prevent access or reduce risk. Lock the device and revoke access promptly where possible. Preserve relevant logs or evidence first when feasible, but do not let evidence collection delay urgent protective action.

Who must be notified if participant health information may have been exposed?

Notify the principal investigator, IT security, the privacy officer, and research compliance or the IRB office as required by institutional policy. The privacy officer should determine whether HIPAA applies and whether a covered entity, business associate, participants, HHS, or other parties must be notified. Sponsor, contract, state-law, and study-specific requirements may also apply.