Stolen Smartphone Incident Response Checklist for Birth Defects Surveillance Programs

What should staff do immediately after a smartphone is stolen?

Report the theft immediately through your program’s incident-reporting channel. Notify your supervisor and the designated privacy, security, or incident-response lead, following your organization’s policies. A prompt report helps the program secure access, review potential exposure, and preserve relevant records. HHS describes identifying, responding to, mitigating, and documenting security incidents as required steps for HIPAA-regulated entities; see its guidance on responding to security incidents.

• Record when and where the phone was last known to be secure, when the theft was discovered, and who had custody of it.
• Use an authorized device or computer to try to locate or lock the phone, if the relevant service was enabled before it was stolen.
• Contact the wireless carrier to report the theft and ask about suspending service or disabling the device.
• Do not attempt to retrieve the phone yourself if doing so could put anyone at risk. Give any location information to law enforcement.
• Do not assume that a screen lock alone means the data is protected. Tell the incident-response lead whether the phone was locked, powered on, encrypted, or configured to display sensitive notifications.

Until the program completes an assessment, handle the event as a possible exposure of identifiable birth defects surveillance data. The program should apply its own policies, applicable data-use agreements, and relevant state or federal requirements; HIPAA applies only when the information and organization fall within its scope.

How can the device and connected accounts be remotely secured?

Ask an authorized administrator to use the program’s remote device management system to lock the phone, revoke its access to organizational services, and—when appropriate—issue a remote erase command. Record who initiated each action, when it was requested, and whether the management console confirmed completion. A remote command may not take effect until the device reconnects.

If the device is an iPhone, Apple says Find My must have been enabled before the loss for the device to appear and be marked as lost or erased. If it is an Android phone, Google’s Find Hub can locate, secure, or erase supported devices. Check the official instructions for finding and marking an iPhone as lost, erasing an Apple device, and securing or erasing an Android device with Find Hub.

Perform account session revocation for the stolen phone and any services it could access. Revoke active sessions or device tokens, disable or reset credentials where warranted, and review recovery methods and multi-factor authentication. Prioritize work email, surveillance databases, cloud storage, messaging, and password-management accounts. Contact the carrier about the phone number and SIM or eSIM, especially if the number can receive account verification codes.

Coordinate a remote erase with the incident lead so the response does not overlook evidence that can be collected from management systems or service logs. If a device cannot be locked or erased remotely, continue securing its connected accounts and assess the risk based on the phone’s configuration and the data it could access.

How should programs assess exposure of identifiable surveillance data?

Determine what information was stored on the phone and what could be reached through its apps, saved credentials, email, messages, photographs, notifications, or active sessions. Include data stored locally, cached for offline use, downloaded as files, or displayed in screenshots. Check whether the phone contained direct identifiers, dates, locations, case details, or combinations of information that could identify a child or family.

Review whether mobile device encryption was enabled and whether the device was locked or powered on when it was taken. Encryption can affect whether electronic protected health information is considered “unsecured” under HIPAA, but do not presume that the presence of an encryption setting resolves the incident. HHS guidance specifies that the encryption process and protection of the decryption key matter; see its guidance on rendering PHI unusable, unreadable, or indecipherable.

Review surveillance data access logs, identity-provider records, application activity, device-management events, and account alerts for activity before and after the theft. Look for unexpected logins, downloads, searches, exports, or changes to account recovery settings. HIPAA-regulated entities must implement audit controls for systems that contain or use electronic protected health information and review system activity as required by the Security Rule; see the HHS audit protocol.

If HIPAA applies and unsecured PHI may have been impermissibly accessed or disclosed, the organization must evaluate the event under its breach notification procedures. HHS identifies four factors for assessing whether there is a low probability that PHI was compromised: the nature and extent of the information, who received or used it, whether it was actually acquired or viewed, and the extent of mitigation. Document the reasoning and conclusion; do not treat missing evidence as proof that no exposure occurred. See the HHS explanation of the four-factor risk assessment.

HIPAA’s breach-notification rules apply to covered entities and business associates when the incident involves unsecured PHI. If the rules apply and notification is required, the covered entity must notify affected individuals and HHS, and in certain circumstances the media, without unreasonable delay and within applicable deadlines. Confirm the program’s legal obligations with its privacy officer or counsel, including state law, contracts, and data-use agreements. HHS summarizes the HIPAA Breach Notification Rule.

When should the theft be reported to law enforcement?

Follow organizational policy and applicable local requirements, and promptly involve law enforcement when the circumstances warrant a theft report—for example, when the phone was taken in a robbery, there is a credible lead, or the carrier or insurer requests a report. Provide the device’s make, model, serial number, and IMEI or MEID if available, along with the time and location of the theft. The FCC’s consumer guidance recommends reporting a stolen wireless device to the police and carrier; see FCC guidance on what to do if a wireless device is stolen.

A police report does not replace the program’s internal incident report or privacy assessment. Share only the information needed to report and investigate the theft. If the program is subject to HIPAA, consult its privacy officer or counsel before disclosing identifiable health information to law enforcement; HIPAA permits certain disclosures for law-enforcement purposes only under specified circumstances. See HHS’s summary of the HIPAA Privacy Rule.

What incident details and evidence should be preserved?

Create an incident record promptly and keep it in the approved restricted-access system. Record facts, not assumptions, and update the record as new information becomes available. Preserve the evidence needed to understand what happened, assess exposure, and demonstrate how the program responded.

• Device make, model, serial number, IMEI or MEID, assigned user, asset tag, and management status.
• The date, time, location, and circumstances of the theft; the last known secure use; and the discovery and reporting times.
• Whether the phone was locked, powered on, encrypted, or configured for remote management, and what surveillance data or accounts it could access.
• Remote-lock, remote-erase, session-revocation, password-reset, and carrier actions, including timestamps, responsible staff, and results.
• Relevant surveillance data access logs, sign-in records, device-management alerts, account notifications, and provider or carrier communications.
• Law-enforcement report details, if a report was made, and the name or case number provided by the agency.
• The program’s exposure assessment, decision-makers, notifications considered or made, mitigation steps, and final rationale.

Preserve logs and records in their original form where possible, restrict access, and follow the organization’s evidence-retention procedures. If HIPAA applies, HHS requires covered entities and business associates to document security incidents and their outcomes; see HHS security incident guidance.

How can programs restore data and prevent future incidents?

Restore work from verified, approved backups or the central surveillance system rather than copying case information from an untrusted device or account. Confirm that the restored data is complete and accurate, and document any gap in records or service. Issue a replacement phone only after it has been configured through approved confidential data handling procedures and the program has confirmed that access is limited to authorized users.

Review the incident for practical improvements: require device encryption and a strong screen lock; enable remote device management and test lock or erase procedures; minimize local downloads and cached identifiable information; use approved apps and storage; and configure automatic locking and multi-factor authentication where supported. HHS advises that mobile access to ePHI requires appropriate safeguards for the device and cloud services; see its guidance on mobile devices and cloud access.

Update incident contacts, staff instructions, access controls, and training based on what the investigation found. Keep the response record, exposure determination, and any required notifications together under the program’s retention rules. A clear sequence—report, secure access, assess data, preserve evidence, meet applicable notification duties, and restore safely—helps protect surveillance information and improve readiness for the next incident.

FAQs

Who should be notified when a program smartphone is stolen?

Notify your supervisor and the program’s designated privacy, security, or incident-response contact immediately, following internal policy. Also notify the device-management administrator and wireless carrier as appropriate. Involve program leadership, the data steward, legal counsel, or a public-health partner when required by policy, contract, or the exposure assessment. External breach notices should be handled by the responsible organization after it determines which laws and agreements apply.

Can a stolen phone be remotely locked or erased?

Often, if the phone and the required management or “find my device” feature were configured before the theft and the device can receive the command. Remote erase may remain pending until the phone reconnects. Ask the authorized administrator to document whether the action was requested and confirmed, and secure accounts separately because remote locking or erasing does not itself revoke every account session.

How should a program determine whether surveillance data was exposed?

Identify what data was stored on the phone or available through connected accounts, then review encryption and lock status, device and account activity, access logs, and signs of viewing or downloads. Assess the sensitivity and identifiability of the information, who may have accessed it, whether it was actually acquired or viewed, and what mitigation occurred. Document the conclusion and consult the privacy officer or counsel about applicable notification requirements.

What information should be included in the incident record?

Include the device and assigned user, theft circumstances and key times, data and accounts potentially accessible, security settings, remote actions and results, relevant logs and communications, any law-enforcement report, the exposure assessment, decisions, mitigation, and notifications. Keep the record factual, access-restricted, and updated as the investigation progresses.