Unencrypted USB Drive Incident Response Guide for Virtual First Health Plans

What should you do immediately after an unencrypted USB drive is lost or exposed?

Treat a missing or exposed USB drive that may contain protected health information (PHI) as a potential security incident. Report it promptly through your organization’s incident-response channel and notify the privacy or security officer, your manager, and any other contacts required by policy. A virtual-first health plan should make these channels accessible to remote employees and contractors.

Record when and where the drive was last known to be secure, who used it, what it may contain, and whether anyone may have accessed it. If the incident involves a business associate, follow the business associate agreement and notify the covered entity promptly; the agreement may require reporting sooner than HIPAA’s outside deadline. HHS explains business associate incident-reporting responsibilities.

Ask the security team to assess whether related accounts, systems, or credentials could be at risk. Preserve relevant logs and access records, and use approved channels to share incident details. Do not delay reporting while trying to locate the drive or determine whether the incident is a reportable breach; those are separate steps in the response.

How should you preserve the USB drive and document the incident?

If the drive is recovered, do not plug it into a personal computer, open its files, delete data, or reformat it. Secure it from further access and contact the incident-response team for instructions. If the drive may be evidence, let authorized personnel decide how to examine it and whether forensic imaging is appropriate.

Document the incident timeline, discovery method, people involved, drive identifier, known or suspected PHI, containment steps, recovery efforts, and relevant system or access logs. Record what is confirmed separately from assumptions, and note when new information changes the assessment. HHS requires regulated entities to identify and respond to suspected or known security incidents, mitigate harmful effects where practicable, and document incidents and outcomes in its Security Incident Procedures guidance.

Retain the incident file and related required documentation under your organization’s retention schedule. The Security Rule requires certain required documentation to be maintained for six years from its creation or the date it was last in effect, whichever is later; see HHS’s Security Rule summary.

What information is needed for a HIPAA breach risk assessment?

Start by identifying the PHI on the drive and the people whose information may be involved. Determine whether it contained names, dates, contact details, health information, account numbers, or other identifiers; how much information was stored; and how readily individuals could be identified or re-identified.

HIPAA presumes an impermissible use or disclosure of PHI is a breach unless an exception applies or the organization demonstrates, through a documented HIPAA breach risk assessment, a low probability that the PHI was compromised. HHS identifies four factors to assess:

• Nature and extent of the PHI: What information and identifiers were involved, and how likely is re-identification?
• Who may have received or used it: Was the drive likely found by someone authorized to access the information, or by an unknown person?
• Whether it was acquired or viewed: Is there evidence of access, copying, or attempted access? What can the available evidence establish?
• Mitigation: What steps reduced the risk, such as recovering the drive or obtaining reliable information about its handling?

Document the evidence, uncertainties, reasoning, and conclusion. Do not treat a lack of evidence of access as proof that no one accessed the information. The four-factor test and documentation expectations are described in the HHS Breach Notification Rule guidance.

When does HIPAA require notification after a USB drive incident?

If the review determines that unsecured PHI was breached, a covered entity must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovering the breach. The notice should describe the incident and information involved, explain steps individuals can take to protect themselves, summarize the organization’s response, and provide contact information. The deadline is tied to discovery; completing the assessment does not create a new 60-day period.

A covered entity must also notify the HHS Secretary. For a breach affecting 500 or more individuals, notice is due without unreasonable delay and no later than 60 calendar days after discovery. For a breach affecting fewer than 500 individuals, the covered entity may report to the Secretary annually, no later than 60 days after the end of the calendar year in which the breach was discovered. If a breach affects more than 500 residents of a state or jurisdiction, the covered entity must also notify prominent media outlets serving that area.

A business associate must notify the covered entity of a breach at or by the business associate without unreasonable delay and no later than 60 days after discovery; its contract may set a shorter reporting deadline. Check the organization’s role, agreement, and incident-response policy, and use the HHS notification requirements to confirm which notices apply.

How does encryption affect breach notification obligations?

Encryption can affect whether PHI is considered unsecured for purposes of the Breach Notification Rule. Under HHS guidance, electronic PHI is treated as secured when it is encrypted in accordance with the applicable guidance and the confidential process or key needed to decrypt it has not been breached. A device described as “encrypted” is not, by itself, enough to establish that this standard was met.

Confirm that encryption covered the PHI on the drive and that the encryption method and key handling meet the applicable standard. Investigate any possible encryption key compromise, stolen credentials, unlocked session, or unencrypted copy. If the key or decryption process may have been compromised, do not assume the encryption removes notification obligations; include that evidence in the risk assessment. See HHS guidance on rendering PHI unusable, unreadable, or indecipherable.

What safeguards reduce the risk of future portable-media incidents?

Review whether employees and contractors need USB drives to perform their work. Where practical, use approved secure systems rather than copying PHI to portable media. If portable storage is necessary, establish portable media safeguards that define approved devices, permitted uses, encryption requirements, storage and transport practices, incident reporting, and secure disposal.

For a distributed workforce, make the rules easy to find and apply across home offices, shared workspaces, and travel. Consider maintaining an inventory or checkout record, restricting unauthorized removable media, using managed devices, limiting access to PHI, and training users on incident reporting. Periodically review whether controls remain appropriate to the organization’s risks and operations. HHS describes its flexible, risk-based approach in the Security Rule risk analysis guidance.

How should USB drives containing PHI be securely destroyed?

Do not rely on deleting files, emptying a trash folder, or performing a quick format to make PHI unrecoverable. The Security Rule requires policies and procedures for the final disposition of electronic PHI and the media that stores it, as well as procedures to remove PHI before media is reused. HHS describes options for reuse and disposal in its electronic media disposal guidance.

Use an organization-approved media sanitization method suited to the specific USB technology and sensitivity of the data. Where the drive cannot be reliably sanitized or is not being reused, use a qualified destruction process that renders the data unretrievable. Keep records of the device, method, date, and responsible party; if a vendor performs the work, document the vendor and applicable safeguards. For current technical guidance, consult NIST SP 800-88 Revision 2, Guidelines for Media Sanitization.

In short, report a lost drive promptly, preserve evidence, document the four-factor assessment, and base notification decisions on the facts and applicable HIPAA deadlines. Strong portable-media safeguards and validated media sanitization help reduce the likelihood of a repeat incident.

FAQs

Who should be notified when an unencrypted USB drive is lost?

Notify your organization’s designated privacy or security officer and incident-response channel as soon as possible, following internal policy. Also notify your manager and, if a business associate is involved, the covered entity as required by the agreement and applicable rules. The covered entity determines any required notices to affected individuals, HHS, or the media after assessing the incident.

Does an unencrypted USB drive containing PHI automatically constitute a reportable breach?

No. A lost drive containing unsecured PHI requires prompt investigation, but it does not automatically mean that individual notification is required. The organization must assess the circumstances, applicable exceptions, and whether it can demonstrate a low probability that the PHI was compromised. Document the decision and its supporting evidence.

What factors determine whether affected individuals must be notified?

The organization assesses the nature and extent of the PHI, who may have received or used it, whether it was actually acquired or viewed, and the extent to which risk was mitigated. If a breach of unsecured PHI is determined and no exception applies, the covered entity must notify affected individuals within the required timeframe.

How can an organization ensure PHI cannot be retrieved from a discarded USB drive?

Use an approved sanitization method appropriate to the device, or have the drive physically destroyed through a qualified process if reliable sanitization is not possible or the device will not be reused. Do not rely on deleting files or quick formatting alone. Keep a record of the method and completion, and follow the organization’s media-disposal policy and applicable guidance.