Lost Device Incident Response Guide for Transplant Information System Vendors

How should vendors identify and report a lost device?

Treat a missing laptop, phone, tablet, removable drive, or other device with access to a transplant information system as a security incident as soon as it is reported. Do not wait to confirm whether the device contains protected health information (PHI) before alerting your incident response team.

Record when the device was last known to be in the user’s possession, when and where it was noticed missing, who used it, and whether theft is suspected. Capture the device type, asset tag, serial number, operating system, assigned user, and any known security or connectivity status. Keep the report factual and note which details remain unconfirmed.

Notify the designated security contact and follow your organization’s incident response plan and customer contract. If your organization is a HIPAA business associate, notify the covered entity under the applicable business associate agreement (BAA). HIPAA requires a business associate to report a breach of unsecured PHI to the covered entity without unreasonable delay and no later than 60 days after discovery; a BAA may require earlier notice. A missing device report is not by itself a final breach determination, so escalate promptly rather than waiting for the investigation to finish. See the business associate notification rule, 45 CFR § 164.410, and HHS breach notification guidance.

What device and system data should responders assess?

Determine what information the device could access, store, display, or synchronize. Check whether it held local files, downloaded reports, cached application data, saved credentials, email attachments, screenshots, or removable media. Assess whether the user could reach transplant-system records through a browser or application even if no PHI was stored locally.

Review the device’s security configuration and management status, including encryption, screen lock, authentication requirements, mobile-device-management enrollment, last check-in, and whether encryption keys or recovery credentials could be accessed from the device. Encryption is relevant to whether PHI may be considered secured under HIPAA, but confirm that it was properly implemented and that the decryption key was not also exposed. HHS explains the applicable encryption standard in its guidance on securing PHI.

Collect relevant access and authentication logs from identity providers, applications, cloud services, VPNs, and device-management tools. Check for logins, failed authentication attempts, unusual locations, data views, exports, downloads, and account changes around the time the device went missing. Establish the period reviewed and any gaps in available logs; absence of a recorded access event does not alone prove that no access occurred.

How can vendors contain access after a device is lost?

Coordinate containment with the incident lead and system owners. Use remote device lock and wipe capabilities when available, but consider whether a forensic snapshot or relevant device-management and access logs should be preserved first. A wipe may remove evidence, so document the decision, approval, timing, and actions taken.

Evaluate credential revocation based on the device’s access and exposure. Revoke or reset passwords, active sessions, refresh tokens, certificates, VPN access, and other credentials that may be stored on or reachable from the device. If compromise is plausible, act promptly rather than waiting for proof of misuse. Confirm that replacement credentials are issued securely and that multifactor authentication remains enabled.

Containment may also include temporarily disabling the affected account, blocking the device from organizational services, and monitoring for suspicious access. HIPAA’s Security Rule requires covered entities and business associates to implement security incident procedures and technical safeguards such as audit controls; consult 45 CFR § 164.308 and 45 CFR § 164.312. Apply your documented policies and contract terms to determine the specific response.

How should teams assess and document potential PHI exposure?

First establish whether the device held or could access PHI, what categories of information were involved, and whose records may have been affected. Assess whether data was encrypted in a manner consistent with HHS guidance and whether the encryption key or credentials could also have been compromised. Consider the device’s last known security state, whether it was locked, and whether remote controls successfully reached it.

If an impermissible use or disclosure of PHI may have occurred, the breach risk assessment should address the required factors: the nature and extent of the PHI and re-identification risk; the person who may have accessed or received it; whether it was actually acquired or viewed; and the extent to which risk was mitigated. HIPAA generally presumes a breach unless an applicable exception applies or the covered entity or business associate demonstrates a low probability that PHI was compromised. See HHS’s explanation of the Breach Notification Rule.

Document the evidence and reasoning supporting the decision, including facts that are unknown or could not be verified. Retain incident timelines, device and account identifiers, log queries and results, containment steps, communications, risk-assessment findings, and the rationale for notification or non-notification. Keep evidence in an access-controlled location and preserve its integrity. NIST recommends recording incident actions and preserving the integrity and provenance of incident data in its SP 800-61 Rev. 3 incident response guidance.

Which security, privacy, and compliance roles should coordinate the response?

Assign an incident lead to coordinate investigation, decisions, deadlines, and status updates. Include security or incident response staff, IT and device-management administrators, the system or application owner, and the employee or manager who can clarify how the device was used.

Involve privacy and compliance personnel to assess potential PHI exposure and applicable reporting duties, and legal counsel when interpretation of the law, contract, or evidence-preservation needs warrants it. Notify the covered entity’s designated contact according to the BAA and customer incident procedures. The covered entity generally handles required notices to affected individuals and HHS, though responsibilities may be delegated as permitted and agreed. HHS describes the business associate’s reporting obligation and the covered entity’s notification responsibilities in its Breach Notification Rule overview.

Keep communications limited to authorized people and avoid circulating PHI or sensitive investigative details more broadly than necessary. If theft is suspected, consult legal counsel and organizational policy about involving law enforcement; do not allow that decision to delay required incident escalation or containment.

How can vendors recover and prevent repeat incidents?

Before restoring the affected user’s access, confirm that exposed credentials and sessions have been addressed, the missing device is blocked where possible, and any replacement device meets the organization’s security requirements. Verify that access is limited to what the user needs and monitor relevant accounts for continued suspicious activity.

Complete corrective action documentation that identifies the incident’s cause, control gaps, decisions made, responsible owners, and target dates for remediation. Actions may include improving device inventory, requiring or validating encryption and automatic locking, refining remote device lock and wipe procedures, reducing locally stored data, strengthening authentication, or improving log coverage. Track each action to completion and review whether it reduced the identified risk.

Use the incident to update response procedures and provide role-appropriate reminders or training based on the organization’s own policies and contractual obligations. A clear report, prompt containment, evidence preservation, documented breach risk assessment, and verified corrective actions help vendors protect PHI and respond consistently to future lost-device events.

FAQs

What information should be included in a lost device report?

Include the reporter’s name and contact details; device type, asset tag, serial number, and assigned user; when and where it was last seen; when it was reported missing; whether theft is suspected; the device’s known encryption and lock status; the systems and data it could access; and actions already taken. Mark unverified details clearly and record the report and escalation times.

How can vendors determine whether PHI was exposed?

Identify what PHI was stored on the device or accessible through it, then review device-management, access and authentication logs, application activity, and available evidence of viewing, downloads, or exports. Assess encryption and key protection, who may have obtained the device, and mitigation steps. If an impermissible use or disclosure may have occurred, document the required HIPAA risk-assessment factors and coordinate the determination with the covered entity as required by the BAA.

When should credentials be revoked after a device is reported missing?

Revoke or reset credentials promptly when they were stored on the device, the device could access active sessions or tokens, or compromise cannot reasonably be ruled out. Prioritize blocking active sessions, tokens, certificates, and remote access as appropriate. Follow the incident response plan and coordinate timing with containment and evidence preservation; do not wait for confirmed misuse if credentials may be exposed.

What records should vendors retain to support a breach determination?

Retain the original report, timeline, device inventory and security details, relevant access and authentication logs, evidence-preservation records, containment and credential-revocation actions, communications with the covered entity, PHI scope analysis, and the documented breach risk assessment and conclusion. Preserve supporting records securely under applicable retention policies and contractual requirements. HHS states that regulated entities must be able to document either that required notifications were made or why notification was not required.