Lost or Stolen 911 Dispatch Radio: PHI Incident Response Checklist

This Lost or Stolen 911 Dispatch Radio: PHI Incident Response Checklist gives you a practical, step-by-step path to contain risk, protect Protected Health Information, and execute your Incident Response Plan with speed and confidence.

Incident Identification

Confirm what happened and when

• Establish discovery details: who noticed, exact time, last known location, and circumstances (misplaced, suspected theft, offsite event, vehicle break-in).
• Record device specifics: make/model, serial number, radio ID/Unit ID, assigned user, talkgroup entitlements, encryption status, GPS/AVL capability, and any CAD or smartphone-tethered functions.
• Decide classification: potential PHI-related security incident if the radio can access encrypted medical talkgroups, receives patient identifiers, or stores text messages, call logs, or contact aliases linked to patients.

Early PHI risk cues

• Unaccounted radio for more than one operational period or evidence of forced entry.
• Device labeled with names, unit assignments, or barcodes that could reveal PHI context.
• Known access to medical or EMS talkgroups where patient identifiers are used over voice.

Document the time of discovery immediately; it starts your Security Incident Reporting timeline and any Breach Notification Requirements clocks.

Initial Response

First 15 minutes

• Alert the shift supervisor and security officer; open a Security Incident Reporting ticket with a clear incident title.
• Attempt contact with the device user; retrace steps and check common areas and vehicles.
• Notify the radio system administrator to monitor for suspicious affiliations or push-to-talk activity from the radio ID.
• Reduce PHI shared over voice on affected talkgroups until risk is assessed; use coded language consistent with policy.

First hour

• Issue an over-the-air inhibit/disable if supported; if not, block the subscriber ID from affiliating to the system.
• Move critical operations to alternate encrypted talkgroups if keys may be exposed.
• Preserve logs: CAD, radio system events, access control, and CCTV where the loss may have occurred.
• Start a Data Exposure Assessment worksheet to track what the device could access or store.

Notification Procedures

• Follow your Incident Response Plan escalation matrix: PSAP leadership, HIPAA Privacy Officer, HIPAA Security Officer, IT/radio engineering, and legal/risk management.
• Notify law enforcement and obtain a case number if theft is suspected.
• Inform county/city communications or radio shop and your managed service/vendor if they host key management or system monitoring.
• Brief EMS partners only on operational impacts; avoid disclosing unnecessary PHI.
• Document every notification with time, person contacted, and instructions given.

PHI Considerations

Protected Health Information may be implicated when a dispatch radio can receive, display, or store data that identifies a patient in the context of care. Even if no data is stored, compromised access could enable unauthorized listening to PHI-bearing traffic.

What to examine

• Stored data: text messages, call logs, contact aliases, quick notes, or photos on LTE-enabled models.
• Access pathways: medical talkgroups, interoperability channels, Bluetooth or Wi‑Fi pairings to tablets/CAD, and authentication tokens.
• Encryption posture: which talkgroups are encrypted, key types in use, and whether the device could be used to affiliate and monitor traffic.

Data Exposure Assessment

• Determine whether the device has been used post-loss (affiliation records, GPS pings, PTT logs).
• Assess likelihood of key or credential compromise; assume exposure until rekeying and revocation are completed.
• Estimate the potential number of individuals whose PHI could be accessed based on talkgroup membership, recent incidents, and recorded transmissions.
• Record mitigating factors: tamper resistance, rapid inhibit, strong encryption, and absence of stored identifiers.

Investigation

• Build a timeline from last verified possession to discovery and subsequent actions (inhibit, rekey, notifications).
• Collect and preserve evidence: facility access logs, vehicle logs, CCTV, dispatch floor footage, and witness statements.
• Review radio/KMF logs for affiliations, key loads, OTAR events, and any anomalous transmissions.
• Maintain chain of custody for recovered devices; do not power on until forensics/administrators advise.
• Identify root causes (policy gaps, storage practices, training, Device Security Configuration issues) and document corrective actions.

Mitigation Steps

Access Credential Management

• Immediately revoke or rotate radio encryption keys (OTAR or physical key load) for at-risk talkgroups.
• Disable the lost radio ID and any associated CAD, VPN, Wi‑Fi, or SSO credentials.
• Reset passwords, revoke tokens, and remove the device from allowlists and MDM inventories.

Technical controls

• Execute over-the-air inhibit/kill and confirm via system logs; if the device is recovered, re-enable only after reimage/reprogram.
• Reprogram talkgroup entitlements to the principle of least privilege for affected roles.
• Increase logging and alerting thresholds on medical talkgroups and gateways for 72 hours.

Operational controls

• Issue temporary radios with fresh keys to impacted users and brief them on PHI-minimization practices.
• Use alternate channels or encrypted telephony for highly sensitive details until rekeying is complete.
• Communicate clear do/don’t guidance to the floor to prevent over-disclosure during the incident window.

Reporting Requirements

• Complete internal Security Incident Reporting within required timeframes and include the Data Exposure Assessment, actions taken, and mitigations.
• Apply HIPAA Breach Notification Requirements if you are a covered entity or part of a hybrid entity: conduct a four-factor risk assessment and, if a breach is determined, notify affected individuals without unreasonable delay (no later than 60 days), and notify regulators and, when applicable, the media per threshold rules.
• Evaluate and comply with applicable state breach laws, union agreements, and local policies that may set shorter deadlines.
• Coordinate all external notifications with legal/risk management to ensure accuracy and consistency.

Recovery & Prevention

Recovery

• Confirm inhibit, rekey, and credential revocations are complete; verify no further affiliations from the lost device.
• For recovered devices, forensically inspect, wipe/reimage, reprogram, and re-enroll before returning to service.
• Close out incident records with a lessons-learned summary and update your Incident Response Plan accordingly.

Prevention and Device Security Configuration

• Harden defaults: enforce encryption by default, enable inhibit/OTAR, disable local data storage where possible, and require PIN-on-power where supported.
• Improve physical controls: secure radio cradles, locking mounts, asset tags, and discreet labeling that avoids PHI or user identity.
• Enhance Access Credential Management: least-privilege talkgroups, periodic key rotation, rapid revocation playbooks, and separation of duties.
• Strengthen processes: check-in/out accountability, off-shift storage policy, and quarterly tabletop exercises focused on PHI scenarios.
• Train staff: voice PHI minimization, secure handling during field operations, and immediate reporting procedures for suspected loss.

FAQs

What should I do immediately after discovering a lost or stolen 911 dispatch radio?

Alert your supervisor, open a Security Incident Reporting ticket, attempt to locate the device, and contact the radio administrator to monitor and inhibit the radio. Minimize PHI over voice, preserve logs, and begin a Data Exposure Assessment while notifications proceed per your Incident Response Plan.

How is PHI exposure assessed in such incidents?

Assess whether the radio stored identifiers, could access medical talkgroups, or was used after loss. Review affiliation/PTT logs, encryption status, and tokens or pairings to other systems. Document mitigating factors (rapid inhibit, strong encryption) and estimate the potential number of affected individuals.

Who must be notified when a dispatch radio with PHI is lost or stolen?

Notify PSAP leadership, the HIPAA Privacy and Security Officers, IT/radio engineering, legal/risk management, and law enforcement if theft is suspected. Include vendors or hosted system providers when they manage keys or monitoring, and record all notifications and guidance provided.

What are the steps to mitigate risks following the loss or theft of a 911 dispatch radio?

Inhibit the device, block its radio ID, rekey affected talkgroups, and revoke all associated credentials. Tighten logging, adjust talkgroup entitlements, issue temporary radios with fresh keys, and provide operational guidance to reduce PHI exposure until all controls are restored.