Unencrypted USB Drive Incident Response Checklist for Incidental Findings

What should you do immediately after finding an unencrypted USB drive?

Treat an unknown USB drive as both a potential security threat and possible evidence. Do not plug it into a computer, phone, printer, or other device to identify its contents. The Cybersecurity and Infrastructure Security Agency (CISA) advises against plugging in lost-and-found USB drives because removable devices can carry malware.

Instead, keep the drive where it is if moving it could disturb evidence, and promptly notify your supervisor or designated security, privacy, or incident-response contact. If you must move it to protect it from loss or damage, handle it as little as possible and place it in a secure location designated by your organization.

• Do not open files, connect the drive, or attempt to scan, copy, or erase it.
• Limit access to authorized responders and follow your organization’s incident-reporting process.
• Record when and where it was found, and report whether anyone may already have connected it to a device.
• Preserve relevant systems and records while responders assess the incident.

An incidental finding does not by itself establish that protected health information (PHI) was exposed or that a reportable breach occurred. It does warrant prompt review under your organization’s security incident procedures. The HIPAA Security Rule’s administrative safeguards require regulated entities to identify and respond to suspected or known security incidents, mitigate harmful effects as practicable, and document incidents and their outcomes; see the HHS HIPAA Security Series guidance on administrative safeguards.

How should you preserve and document the drive and chain of custody?

Use your organization’s evidence-handling process to keep the drive secure and record each transfer. A clear chain of custody helps responders understand who handled the device, when it changed hands, and where it was stored. Do not assume that a specific form or process applies everywhere; follow organizational policy and any instructions from incident responders or legal counsel.

Document the discovery promptly, using factual, neutral language. Record details such as:

• Date, time, and exact location of discovery, including the time zone if relevant.
• Name and role of the person who found the drive, and the names of people notified.
• Physical description, visible labels, make or model, serial number if visible, and condition of the device.
• Whether it was connected to a computer or other equipment, and who connected or handled it, if known.
• Where the drive was secured, who had access, and the date, time, and purpose of each transfer.
• Response actions, decisions, and outcomes, including when the device was examined or returned to secure storage.

Preserve relevant access logs and other records that could clarify whether the drive was connected to organizational equipment. Depending on the circumstances, responders may also consider endpoint records, removable media control logs, surveillance footage, or other available evidence. Restrict access to incident documentation and handle it according to your organization’s records and security policies.

How do you assess what information may have been exposed?

Have authorized personnel determine whether the drive belongs to your organization, a workforce member, a patient, a business associate, or someone else. Use a controlled forensic process rather than connecting the device to an ordinary workstation. The examination should establish what information was stored, whether it included PHI, and whether the information was encrypted in a manner that meets HHS guidance.

If PHI may be involved, identify the information and people potentially affected as precisely as the available evidence allows. Consider whether files contain direct identifiers, clinical or financial information, or combinations of details that could make an individual identifiable. Also establish when the drive left authorized custody, how long it was unaccounted for, who might have obtained it, and whether evidence indicates that its contents were accessed or copied.

Keep the assessment grounded in documented evidence. Record what investigators could and could not establish, which systems or logs they reviewed, and any uncertainties. The absence of evidence that someone opened files may be relevant, but it does not by itself answer whether PHI was acquired, accessed, used, or disclosed.

Which teams and service providers should coordinate the response?

Assign a response lead and involve the people responsible for privacy, information security, IT, compliance, and legal review. Depending on the facts, include the department responsible for the device, records management, risk management, communications, or leadership. Coordinate through a defined process so that evidence is preserved and decisions are documented consistently.

If a vendor or business associate may own the drive, hold relevant information, or have been involved in the incident, review the applicable agreement and contact the appropriate representative. HIPAA requires business associates to report security incidents to the covered entity or business associate whose ePHI they maintain, as addressed in HHS guidance on security incident reporting by business associates. Contract terms may set reporting details or deadlines that are more specific than the federal outer limit.

Consider contacting law enforcement when facts suggest theft or another crime, in coordination with your organization’s legal and security teams. Avoid making public statements or contacting potentially affected individuals before the appropriate decision-makers have assessed the facts and notification obligations.

What containment and mitigation steps can limit further exposure?

Secure the physical drive and restrict access while the investigation proceeds. If it may have been connected to an organizational device, ask security staff to assess that system and preserve relevant activity records before routine retention processes overwrite them. Do not wipe or reconfigure a potentially affected computer before responders decide whether it may contain useful evidence.

Based on the investigation, responders may disable unauthorized removable-media access, review device-management alerts, secure related accounts or encryption keys, and monitor for suspicious activity. Apply changes carefully: containment measures should reduce ongoing risk without destroying evidence or disrupting essential services unnecessarily.

Document each mitigation action, its timing, and its outcome. HIPAA’s security incident procedures call for mitigation, to the extent practicable, of harmful effects known to the organization. For further context, see the HHS guidance on responding to security incidents.

How do you determine whether notification is required?

First determine whether the incident involved PHI and whether an impermissible acquisition, access, use, or disclosure occurred. Under the HIPAA Breach Notification Rule, an impermissible use or disclosure is generally presumed to be a breach unless the covered entity or business associate demonstrates a low probability that the PHI was compromised, based on a risk assessment. The HHS Breach Notification Rule guidance identifies four factors to assess:

• The nature and extent of the PHI involved, including identifiers and the likelihood of re-identification.
• The person who used the PHI or to whom it was disclosed.
• Whether the PHI was actually acquired or viewed.
• The extent to which the risk to the PHI has been mitigated.

Document the evidence, analysis, and conclusion. A drive being unencrypted does not, by itself, establish that a HIPAA breach occurred; likewise, the fact that a drive was later recovered does not automatically show that the risk was low. Consider other applicable federal or state laws, contracts, and organizational policies, since they may create additional incident notification obligations.

If a covered entity determines that notification is required, affected individuals must generally be notified without unreasonable delay and no later than 60 calendar days after discovery of the breach. For a breach affecting 500 or more individuals, the covered entity must notify HHS without unreasonable delay and no later than 60 days after discovery; for fewer than 500 individuals, HHS notification is due within 60 days after the end of the calendar year in which the breach was discovered. Media notice is required when the breach affects more than 500 residents of a state or jurisdiction. See HHS instructions for reporting breaches. A business associate must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery, subject to applicable agreement terms.

When can the drive be sanitized and how can similar incidents be prevented?

Do not erase, sanitize, return, or destroy the drive until the response lead has confirmed that examination is complete and any evidence-preservation, legal-hold, retention, or law-enforcement needs have been addressed. Document who authorized the decision and when it was carried out.

If the drive contains ePHI and will be reused or disposed of, follow your organization’s approved media sanitization process. The HIPAA Security Rule requires policies and procedures for final disposition of ePHI and for removing it from electronic media before reuse. HHS describes methods that may include clearing, purging, or destroying media, depending on the circumstances; see the HHS guidance on reusing or disposing of electronic media. Choose a method appropriate to the device and risk, and document completion.

Reduce the chance of repeat incidents with clear removable media control: define who may use USB drives, require approved devices and encryption where appropriate, control how media enter and leave facilities, and train workforce members to report found or lost devices immediately. Review the response afterward, update procedures where needed, and confirm that staff know not to plug in unknown drives. Prompt reporting, careful evidence preservation, a documented HIPAA breach assessment, and verified media sanitization help limit harm and support a defensible response.

FAQs

Should I plug in an unknown USB drive to identify its contents?

No. Do not connect an unknown drive to a computer or other device. It could contain malware, and connecting it may alter evidence. Secure it and report the finding so authorized responders can assess it using a controlled process.

What details should be recorded when an unencrypted USB drive is discovered?

Record the date, time, and location; who found and handled it; its visible description and identifiers; whether it was connected to any device; where it was secured; each transfer or access; and all response actions. Follow your organization’s documentation and chain-of-custody procedures.

When must affected individuals be notified of a reportable HIPAA breach?

A covered entity must generally notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a reportable breach of unsecured PHI. HHS notification and, in some cases, media notification also apply, with requirements varying by the number of individuals affected. Consult the HHS Breach Notification Rule guidance and your organization’s privacy and legal teams for the specific incident.

When is it safe to erase or destroy the USB drive?

Only after authorized responders determine that examination is complete and any evidence, retention, legal-hold, or law-enforcement needs have been resolved. If the drive contains ePHI, sanitize or destroy it using an approved method before reuse or disposal, and document the authorization and completion.