Stolen Tablet Incident Response Guide for Home Infusion Nursing Agencies

What should staff do immediately after a tablet is stolen?

Report the theft immediately to your agency’s supervisor, privacy officer, or security team using the organization’s incident-reporting process. A nurse should report the incident even if the tablet was password-protected; a passcode alone does not establish whether protected health information (PHI) was exposed.

Give the response team the facts you know: when and where the tablet went missing, who last had it, whether it was left unattended or taken, and which agency apps or accounts were signed in. Do not delay reporting while trying to locate the tablet or determine whether patient information was accessed. The HIPAA Security Rule requires covered entities to identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and their outcomes, as described in HHS guidance on Security Rule incident procedures.

• Ask IT or the authorized administrator to lock the tablet and secure agency accounts.
• Report theft to law enforcement when appropriate under agency policy and local procedures; record any report or case number.
• Do not attempt to retrieve the tablet yourself or contact a suspected thief if that could put you or others at risk.
• Use approved agency channels to arrange needed patient-care coverage and access to essential records.

How should the agency assess the device and patient information at risk?

Start by identifying what information the tablet could access or store—not just what was visible on its home screen. Check whether patient names, contact details, infusion schedules, medication or treatment notes, photographs, messages, downloaded files, or cached records were stored locally or available through signed-in apps. Also establish whether the tablet was connected to email, the electronic health record, cloud storage, or other agency systems.

Record the device’s model, asset tag or serial number, assigned user, operating-system status, last known location, and whether it was powered on, locked, or in use when lost. Determine what authentication protections were enabled, whether the screen displayed sensitive notifications, whether data was protected by encryption at rest, and whether there is evidence of access after the theft. HHS says a Security Rule risk analysis must account for ePHI across electronic media, including portable devices; see HHS guidance on Security Rule risk analysis.

Separate the operational security review from the HIPAA breach risk assessment. The agency should first contain the incident and establish the facts. If PHI may have been acquired, accessed, used, or disclosed impermissibly, the Breach Notification Rule generally presumes a breach unless the covered entity or business associate documents a low probability that the PHI was compromised based on the required risk assessment. The assessment considers the nature and extent of the PHI, who used or received it, whether it was actually acquired or viewed, and the extent to which the risk was mitigated. These factors are explained in the HHS Breach Notification Rule overview.

Encryption can affect whether PHI is considered “unsecured” under the breach rule. HHS guidance says PHI encrypted using an applicable process is not unsecured PHI if the confidential process or key needed to decrypt it has not also been compromised. Confirm what encryption was in place and whether the tablet’s state—for example, powered off or already unlocked—changes the assessment. Refer to HHS guidance on rendering PHI unusable, unreadable, or indecipherable; do not assume a password alone is encryption or proof that data was safe.

How can the agency remotely lock or wipe a stolen tablet?

An authorized administrator should use the agency’s approved mobile device management (MDM) console or the device’s supported management service. If available, place the tablet in lost mode or remotely lock it first. The administrator can then assess whether a remote device wipe is appropriate under agency policy and incident-response procedures.

Before wiping, preserve relevant management and access logs if doing so will not delay necessary protection. A wipe may remove information useful to an investigation, while leaving the tablet at risk may expose patient data. The incident lead and IT should make that decision promptly, document the rationale, and coordinate the action.

Remote commands depend on the device and its management setup. For example, Apple says its managed lock and erase options apply to eligible enrolled devices, and an erase command may not reach a device until it can connect to the internet; see Apple’s device management guidance. If a tablet is not enrolled or cannot receive a command, IT should still revoke its access to agency systems and take other available account-security steps.

As part of access revocation, IT should consider disabling the user’s sessions and tokens, changing credentials that may be exposed, and blocking the device from email, EHR, VPN, or other agency services. Follow agency policy and the relevant platform’s procedures; do not rely on a remote wipe as the only containment measure.

When must the agency report a suspected breach to regulators and affected individuals?

A stolen tablet is not automatically a reportable HIPAA breach. The agency must assess whether PHI was involved, whether there was an impermissible acquisition, access, use, or disclosure, and whether an exception or a documented low-probability risk assessment applies. If the PHI was properly encrypted and the decryption key was not compromised, it may not be “unsecured PHI” subject to HIPAA breach notification. The agency should document its decision either way.

If the agency is a HIPAA covered entity and determines that a breach of unsecured PHI occurred, it generally must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. The covered entity must also notify the HHS Secretary. For a breach affecting 500 or more individuals, notice to HHS is due without unreasonable delay and no later than 60 days after discovery. For a breach affecting fewer than 500 individuals, the agency may report to HHS annually, no later than 60 days after the end of the calendar year in which the breach was discovered. If 500 or more residents of a state or jurisdiction are affected, media notice may also be required. See the HHS notification requirements.

If the home infusion agency is acting as a business associate rather than the covered entity, it must notify the covered entity under the applicable business associate agreement and HIPAA requirements. HHS states that a business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery; the agreement may set a shorter deadline. State law, contracts, or other obligations may also require additional or faster action, so involve the agency’s privacy officer and legal counsel promptly.

How should the agency document the incident and preserve evidence?

Keep a clear, time-stamped incident record from the first report through closure. Include when the tablet was last seen, when the theft was discovered and reported, who handled each response step, the device and accounts involved, and the actions taken to lock, locate, disable, or wipe it. Record the facts known at each stage and distinguish confirmed findings from assumptions.

Preserve relevant evidence, including MDM status and command logs, device inventory records, login and access logs, EHR audit records, account alerts, and any available security-camera or law-enforcement information. Limit access to the investigation file to authorized personnel, retain original records where possible, and record how evidence was collected and transferred. HHS guidance identifies preserving evidence, mitigating harm, documenting the incident and its outcome, and evaluating the event as parts of incident response; see HHS Security Series guidance on administrative safeguards.

Document the breach risk assessment, the PHI and individuals potentially involved, the rationale for the notification decision, notifications made or not made, and any corrective actions. HIPAA-required documentation under the Security Rule generally must be retained for six years from its creation or from when it was last in effect, whichever is later; other laws, contracts, or agency policy may require longer retention. See HHS guidance on documentation and retention.

What steps can prevent future tablet theft and data exposure?

Build practical safeguards into routine home-visit workflows. Assign each tablet to a staff member, maintain an accurate device inventory, and require staff to keep devices secured and attended during travel and visits. Train staff to report a missing device immediately and rehearse the agency’s response process.

Use MDM where appropriate to manage device security, enforce strong authentication and automatic screen locking, keep operating systems and approved apps current, and support remote locking or wiping. Limit local storage of PHI when it is not needed for care, control access to agency systems, and use encryption at rest appropriate to the device and agency risk analysis. The HIPAA Security Rule requires reasonable and appropriate administrative, physical, and technical safeguards; it does not prescribe one specific MDM product or security configuration. See the HHS summary of the HIPAA Security Rule.

Review device controls after incidents, changes in technology, or changes in how staff provide care. In short, rapid reporting, prompt access revocation, a fact-based breach risk assessment, careful evidence preservation, and stronger device controls help protect patients and guide a compliant response.

FAQs

Should a nurse report a stolen tablet if it was password-protected?

Yes. Report it promptly under agency policy even if it was password-protected. A password does not by itself establish whether PHI was stored, encrypted, accessed, or otherwise exposed; the agency must assess those facts.

Can an agency remotely erase a stolen tablet without recovering it?

Often, if the tablet was enrolled in a supported device-management service and can receive the command. Whether a remote wipe is available depends on the device, enrollment, and connectivity. IT should also revoke access to agency accounts and document the response.

When does a stolen tablet become a reportable HIPAA breach?

When the incident involves a breach of unsecured PHI and no applicable exception or documented low-probability risk assessment removes the notification obligation. Theft alone does not settle the question; the agency must assess the information, encryption, access, and mitigation evidence.

What records should an agency keep after a tablet theft?

Keep the incident timeline, device and account details, access and MDM logs, response actions, evidence records, breach risk assessment, notification decisions, and corrective actions. Retain HIPAA-required documentation for at least six years from creation or the date it was last in effect, whichever is later, and check for longer requirements under applicable law, contracts, or agency policy.