Lost Device Incident Response Guide for Pregnancy and Addiction Treatment Clinics

What should staff do immediately after a device is lost?

Report the missing phone, tablet, laptop, USB drive, or other device to your supervisor and the clinic’s privacy or security officer as soon as you discover it. Follow your incident-response policy even if you think the device contains no patient information; it may hold saved files, messages, photos, or credentials that provide access to electronic records.

• Tell IT or your managed service provider the device’s type, owner, last known location, and when it was last seen. Ask them to disable access, revoke active sessions or tokens, and use approved location, lock, or remote-wipe tools as appropriate.
• Do not try to recover the device in a way that could put anyone at risk. If theft is suspected, follow clinic policy for contacting law enforcement.
• Preserve relevant evidence, such as device-management logs and account activity. Avoid deleting records or changing settings without coordinating with IT.
• Record the times of discovery, internal reporting, containment steps, and any new information. Do not include patient details in broad or unsecured communications.

Prompt containment helps limit exposure, but it does not determine whether notification is required. The clinic’s privacy or security officer should lead the review under the incident-response plan.

How should clinics assess the risk of exposed patient information?

A lost device is not automatically a reportable breach. Under HIPAA, an impermissible access, use, or disclosure of protected health information (PHI) is generally presumed to be a breach unless an exception applies or the clinic documents a risk assessment showing a low probability that the PHI was compromised. HHS identifies four factors for that assessment:

• Nature and extent of the information: Identify the data involved, including patient identifiers and whether the information could be linked to a person. Pregnancy, addiction-treatment, appointment, and medication details may be especially sensitive in practice.
• Who could have accessed it: Consider whether the device was likely recovered by someone known and trustworthy or was exposed to an unknown person.
• Whether it was actually accessed or acquired: Review available device, application, and account logs. The absence of evidence of access is relevant, but does not by itself prove no access occurred.
• How much risk was mitigated: Consider whether the device was recovered, accounts were secured, data was remotely erased, or another effective step reduced the chance of access.

Assess what the device could access, not only what was visibly stored on it. A device with no downloaded records may still expose PHI through an open application, saved credentials, email, or an active session. HHS summarizes the presumption of breach and the four-factor HIPAA breach risk assessment.

When does encryption make lost information secured?

HIPAA breach-notification duties generally apply to unsecured protected health information. For electronic PHI to qualify as secured under HHS guidance, it must be encrypted using a specified process that renders it unusable, unreadable, or indecipherable to unauthorized people, and the confidential process or decryption key must not have been compromised. A device password or screen lock alone does not establish that the information meets this standard.

HHS points to encryption processes consistent with designated NIST guidance for data at rest and specified standards for data in motion. Confirm how the clinic’s device encryption was configured and whether it protected all relevant storage. Check whether the key, recovery credentials, or an unlocked session were stored with the device or could also have been accessed. HHS’s guidance on approved encryption methods explains the criteria.

If encryption meets the guidance and there is no decryption key compromise, the information may not be “unsecured” for HIPAA breach-notification purposes. If the encryption is uncertain or the key may have been exposed, investigate and assess the facts rather than assuming the notification safe harbor applies.

What HIPAA notifications are required after a breach?

If the clinic determines that a breach of unsecured PHI occurred, a HIPAA-covered clinic must notify affected individuals, HHS, and—when the applicable threshold is met—prominent media outlets. Individual notice must be provided without unreasonable delay and no later than 60 calendar days after discovery. It should describe the breach and information involved, explain steps people can take to protect themselves, summarize the clinic’s investigation and mitigation, and provide a contact method.

A business associate that discovers a breach must notify the covered clinic under the applicable rule and its business associate agreement; the covered clinic remains responsible for ensuring required individual notices are provided. Other federal or state laws and contractual duties may also apply, so evaluate those separately. HHS outlines the HIPAA notification requirements.

How do reporting deadlines differ for breaches affecting 500 or more people?

The number affected changes the deadline for reporting to the HHS Secretary—not the 60-day deadline for notifying individuals. For a breach affecting 500 or more people, the clinic must notify the Secretary without unreasonable delay and no later than 60 calendar days after discovery. For a breach affecting fewer than 500 people, the clinic may report to HHS annually, but the report is due no later than 60 days after the end of the calendar year in which the breach was discovered.

Media notice is a separate threshold: it is generally required when the breach affects more than 500 residents of a state or jurisdiction. That notice is also due without unreasonable delay and within 60 days of discovery. Do not treat “500 or more affected people” as automatically meaning the media threshold is met; check where affected individuals reside. HHS provides current instructions for HHS breach reporting thresholds.

What additional breach-notification rules apply to Part 2 records?

Some substance use disorder treatment records are protected by 42 CFR Part 2. Whether the rule applies depends on the program and records involved; not every addiction-related record at every clinic is automatically a Part 2 record. As of February 16, 2026, covered entities and programs were required to comply with the applicable requirements of the 2024 Part 2 final rule.

Under 42 CFR § 2.16(b), the HIPAA breach-notification provisions apply to Part 2 programs’ breaches of unsecured records in the same manner they apply to covered entities’ breaches of unsecured PHI. That generally means notification to affected patients, the Secretary, and, when required, the media. A clinic that is both a HIPAA-covered entity and a Part 2 program should evaluate its duties in each applicable role. Review the HHS overview of Part 2 and the 2024 Part 2 final rule.

What response actions and assessment decisions must clinics document?

Keep a clear incident file so the clinic can show what happened, what it did, and why it did or did not notify people. HIPAA places the burden on covered entities and business associates to demonstrate that required notifications were made or that notification was not required. HHS describes this documentation expectation in its Breach Notification Rule guidance.

• Document the device, its owner, the timeline, where it was last seen, and what systems or records it could access.
• Record encryption settings, screen-lock protections, key storage, remote-management capabilities, and any evidence of access or attempted access.
• Preserve the four-factor HIPAA breach risk assessment, supporting evidence, assumptions, and the reasoning behind the final decision.
• Record containment and mitigation actions, including session revocation, credential changes, device recovery or wipe, and steps taken to reduce potential harm.
• Keep copies of notices, HHS submissions, media notices when applicable, business-associate communications, and decisions about whether notification was required.

Use your incident file to make the decision traceable: identify what information may have been exposed, how you evaluated the risk, what you did to limit harm, and which notification duties applied.

FAQs

Is a lost device automatically a reportable breach?

No. A lost device triggers a prompt investigation, but it is not automatically a reportable breach. Determine whether unsecured PHI was involved and apply the required risk assessment and any relevant breach exceptions. If the PHI was secured using HHS-specified encryption and the key was not compromised, HIPAA breach notification may not be required.

What should a clinic do first when a device is missing?

Immediately notify the clinic’s designated supervisor or privacy/security officer and IT team. Follow the incident-response plan to secure accounts, disable access, locate or lock the device, and consider remote wiping while preserving evidence.

Does encrypted patient information require breach notification?

Not necessarily. If the encryption meets HHS guidance and the confidential key or process was not compromised, the PHI may be considered secured for breach-notification purposes. Verify the implementation and key status; a password or screen lock alone is not enough to establish this.

How soon must a clinic notify affected individuals?

When notification is required, the clinic must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. The number of people affected does not extend that individual-notification deadline.