Stolen Laptop Incident Response Checklist for Protecting Body Scan Results

What should you do immediately after a laptop containing body scan results is stolen?

Report the theft immediately through your organization’s security incident process. Notify your supervisor, IT or security team, privacy officer, and incident response lead, and follow internal escalation procedures. A stolen device is a security incident to investigate even if you do not yet know whether anyone accessed its contents.

Record when and where the laptop was last seen, when the theft was discovered, who used it, and what applications or storage locations it could access. Provide the device make, model, serial number, and asset tag if available. Report the theft to law enforcement when appropriate, and retain any report or case number.

Ask IT to use available remote device lock and wipe controls, disable the device’s access to organizational services, and revoke active sessions or tokens. Coordinate these steps with the incident response lead so investigators can consider evidence preservation before wiping. HHS recommends promptly reporting lost or stolen equipment to a supervisor or IT professional in its Health Industry Cybersecurity Practices guidance.

Do not assume that body scan results are protected health information (PHI) in every situation. Identifiable scan results maintained or transmitted by a HIPAA covered entity or business associate may be PHI; the organization’s privacy or legal team should assess the data and the organization’s role.

How can you contain access and preserve incident evidence?

Have authorized IT staff disable the laptop’s accounts and revoke credentials, authentication tokens, certificates, and remote access that could be used from the device. Reset credentials if there is a reason to believe they were exposed, and review whether the laptop could reach email, cloud storage, imaging systems, or other repositories containing PHI.

Use remote device lock and wipe where appropriate, but coordinate first with responders. A wipe may reduce the chance of further access while also removing information that could help establish what happened. Record who authorized any remote action, when it occurred, and what systems or data it affected.

Preserve available access and authentication logs, endpoint-management records, encryption status, cloud and application audit logs, and relevant security alerts. Limit evidence handling to authorized personnel, document each collection or change, and retain copies in a secure location. HIPAA requires regulated entities to identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and their outcomes, as described in HHS guidance on security incident response.

How do you identify affected body scan records and individuals?

Determine what information was stored locally or accessible through the laptop. Check for scan images, measurements, reports, exports, cached files, downloads, email attachments, removable-media copies, and locally stored credentials. Include files synced to cloud services if the laptop could access or download them.

Use system and application records to identify the relevant time period, accounts, folders, and records. Match affected scans to individuals using authorized sources, and document any uncertainty—for example, whether a file contained a name, another identifier, or information that could reasonably be linked to a person.

Also determine whether anyone accessed the laptop or related accounts after the theft, whether data was copied or transmitted, and whether containment actions prevented further access. HIPAA’s breach risk assessment considers the type and extent of PHI, who received or used it, whether it was actually acquired or viewed, and how the risk was mitigated; see the HHS Breach Notification Rule overview.

How does encryption affect the breach risk assessment?

Verify whether full-disk encryption was enabled and operating when the laptop was stolen. Confirm the encryption method and device status, whether the laptop was powered off or locked, and whether a password, recovery key, or encryption key was exposed or stored with the device. Encryption is relevant only if it rendered the PHI unusable, unreadable, or indecipherable to unauthorized people and the key or confidential process was not compromised.

Under HHS guidance, ePHI encrypted using a specified method, with the decryption key not breached, is treated as secured PHI for the Breach Notification Rule. A powered-off laptop with correctly implemented full-disk encryption may therefore fall outside breach-notification requirements. But encryption alone does not settle the issue: device state, implementation, and possible encryption key exposure matter. See HHS guidance on rendering PHI unusable, unreadable, or indecipherable and its ransomware and HIPAA guidance.

If the PHI was not adequately encrypted, treat it as potentially unsecured and conduct the required breach risk assessment. Do not infer that information was protected merely because an encryption feature was available or enabled at some point.

What should the investigation document?

Create a dated incident record that captures the facts, actions, decisions, and supporting evidence. Include:

• The device identity, assigned user, location, and known timeline of loss and discovery.
• The systems and data the device could access, including the body scan records and individuals potentially affected.
• Encryption configuration and device state, plus any findings about passwords, credentials, or encryption key exposure.
• Relevant access and authentication logs, other audit records, evidence sources, and the results or limitations of the review.
• Containment and mitigation actions, including account restrictions, credential changes, remote lock or wipe, and when each action occurred.
• The breach risk assessment, its supporting facts, the notification decision, and any consultations with privacy, legal, security, or incident response personnel.

For a breach risk assessment, address all four HIPAA factors: the nature and extent of the PHI and likelihood of re-identification; the person who used or received it; whether it was actually acquired or viewed; and the extent to which risk was mitigated. Keep documentation that supports the decision to notify or not notify; HHS explains these requirements in its Breach Notification Rule guidance.

When are breach notifications required?

Under HIPAA, an impermissible use or disclosure of PHI is generally presumed to be a breach unless an exception applies or the covered entity or business associate can demonstrate a low probability that the PHI was compromised through a risk assessment. The notification rule applies to breaches of unsecured PHI; properly encrypted PHI whose key was not compromised may not require breach notification under the HIPAA rule. Make the decision from the documented facts, not from the theft alone.

When notification is required, covered entities must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. A breach affecting 500 or more individuals requires notice to HHS without unreasonable delay and within 60 days; for fewer than 500 individuals, HHS reporting is generally due within 60 days after the end of the calendar year in which the breach was discovered. If a breach affects more than 500 residents of a state or jurisdiction, notice to prominent media outlets serving that area is also required. See HHS notification requirements.

A business associate must notify the covered entity of a breach under HIPAA’s rules, and the applicable business associate agreement may require faster reporting. Check that agreement and consult privacy or legal counsel about applicable state laws and other breach notification obligations.

What safeguards help prevent another stolen laptop incident?

Reduce the amount of PHI stored on laptops by using approved secure systems instead of local copies where practical. Require full-disk encryption on devices that may hold ePHI, manage encryption keys separately, and verify that encryption is actually enabled and enforced.

Use strong authentication, automatic screen locking, least-privilege access, and remote device lock and wipe capabilities. Keep devices updated, maintain accurate asset inventories, and review access and authentication logs for unusual activity. Train staff to secure equipment in transit and to report loss or theft promptly.

Test incident response procedures so staff know whom to contact and responders can quickly disable access, preserve evidence, identify records, and assess notification requirements. HIPAA requires security incident procedures and a risk analysis, while encryption is an addressable implementation specification that must be evaluated and implemented when reasonable and appropriate or addressed through an appropriate alternative. See the HHS Security Rule summary.

In short, respond quickly, contain access without overlooking evidence, identify the specific body scan records involved, and document the encryption and breach risk assessment. Use those findings to determine whether notification is required and to strengthen safeguards for future devices.

FAQs

Should a stolen laptop containing body scan results be reported immediately?

Yes. Report it immediately through your organization’s incident response process to the appropriate supervisor, IT or security team, and privacy contact. Prompt reporting helps the organization disable access, preserve relevant evidence, identify affected information, and assess any breach notification obligations.

How can an organization determine whether body scan results were exposed?

Identify the files and systems the laptop could access, then review available access and authentication logs, application records, endpoint-management data, and cloud audit records. Determine whether the device or accounts were accessed after the theft and whether scan information was viewed, copied, or transmitted. Document any limits in the evidence.

Does encryption prevent a stolen laptop incident from being reportable?

Not automatically. Properly implemented encryption may mean PHI is not “unsecured” under HIPAA if the decryption key or confidential process was not compromised. The organization should verify the encryption method and device state and check for key exposure. If the PHI was unsecured, conduct the required breach risk assessment to determine whether notification is required.

What evidence should be preserved during the investigation?

Preserve the device and asset details, incident timeline, encryption and device-state information, access and authentication logs, endpoint and cloud records, relevant alerts, and documentation of containment actions such as remote locking or wiping. Record who collected or changed evidence and when, and retain the risk assessment and notification decision with supporting documentation.