What to Do If a Smartphone Containing Infant Scan Data Is Stolen

Act quickly, but preserve information that may help you recover the phone or determine whether infant imaging data was exposed. Lock the device, contact your carrier and police, secure accounts that were signed in, and notify the organization responsible for any cloud repository containing the scans.

How to locate, lock, or remotely erase the stolen smartphone

Use the phone maker’s official service from a trusted device to check its location and lock it. If you use an Apple device, Apple Support explains how to locate a device and turn on Lost Mode. For Android, Google’s Find Hub instructions cover locating, securing, or erasing a device. Sign in by typing the service’s known address yourself rather than following links in unexpected messages.

Start with a remote lock or lost-device mode if available. These features can protect access while giving you time to check the location and decide whether recovery is possible. Do not go to a reported location or confront anyone yourself; give location information to police.

Remote erase may be appropriate if you believe the phone cannot be recovered or that the data is at immediate risk. Consider the trade-off first: erasing can affect your ability to locate the phone, and the command may not take effect until the phone reconnects. Apple notes that an offline erase can remain pending; Google warns that a factory reset removes the device from Find Hub. Apple’s erase guidance and Google’s Android guidance describe those platform-specific effects.

Erasing the phone does not necessarily delete infant scan files already synced to a cloud repository or held by an imaging provider. If the phone was managed by an employer or clinic, contact its IT or security team before taking action if you can do so promptly. Its remote device management process may be able to lock or wipe the device and help preserve relevant records.

What information to provide when reporting the theft to police and your carrier

Contact your mobile carrier promptly to suspend the SIM or service and ask whether it can block the device from its network. Give the carrier the phone number, make and model, approximate time and place of theft, and the IMEI number if available. The IMEI identifies the device; it does not by itself prove who used it or whether files were opened. The FCC advises reporting a stolen device to the carrier and police and providing its IMEI or MEID when available.

Report the theft to local police and request a report or incident number. Provide the device’s make, model, color, serial number or IMEI, phone number, last known location, and any relevant tracking screenshots. Describe the infant scan data that may have been on the phone, but avoid sending the scans themselves unless investigators specifically request them through a secure process.

Keep copies of the carrier’s confirmation, police report number, and any claim or support reference numbers. If you do not know the IMEI, check the original packaging, purchase records, carrier account, or the device account page from another trusted device.

How to change passwords and revoke active account sessions

From a device you trust, secure the email account used to reset other passwords, then change the password for the phone’s primary account and any account that could expose the scans. Use unique passwords and turn on multifactor authentication where available. If the stolen phone could receive verification codes, contact your carrier about replacing or protecting the number.

Use each account’s security settings to review signed-in devices and perform account session revocation or sign-out for the stolen phone and any session you do not recognize. Changing a password may not end every session or revoke every connected app, so check those controls separately. Apple explains how to review and remove devices from an Apple Account; Google explains how to respond to unfamiliar account activity.

Also review connected apps, recovery email addresses, phone numbers, shared folders, and any infant-scan application account. If a work or clinic account was on the device, report the theft to the organization’s IT or security contact rather than relying only on personal password changes.

Who to notify if infant scans were stored in a cloud repository

Notify the organization that collected, created, or manages the scans—for example, the imaging provider, clinic, hospital, employer, or research organization. Ask for its privacy or security contact and explain that a phone with possible access to infant imaging data was stolen. If the scans were stored in a personal cloud account, contact that service’s support or security team as well.

Ask the repository administrator to secure the account and shared links, review cloud repository access logs and sign-in history, preserve relevant records, and tell you whether the stolen phone had access to the files. Ask what the logs can show, such as sign-ins, file views, downloads, sharing changes, or device details; available records vary by service and account settings.

If a healthcare organization or its business associates maintained the data, its privacy or security team should assess the incident and any required data breach notification. Under HHS’s HIPAA guidance, the Breach Notification Rule applies to covered entities and business associates after a breach of unsecured protected health information; whether a particular theft meets that standard depends on the facts and assessment. HHS explains the rule and its notification requirements. A person’s private storage of scans does not, by itself, establish that HIPAA applies.

How to assess exposure of infant scan files and linked account data

Work with the repository or account administrator to identify exactly what was on the phone and what it could access. Consider whether scan files were stored locally, visible in previews or downloads, synced to cloud storage, or available through an app that remained signed in. Include linked information such as the infant’s name, date of birth, patient or account number, appointment details, and caregiver contact information.

Ask whether the phone had a passcode or biometric lock, whether the scans were encrypted, whether the account required a separate sign-in, and whether remote locking or erasure succeeded. Treat these details as inputs to an assessment, not proof that files were or were not accessed. A missing phone alone does not establish that someone opened or copied the scans.

Request review of available access records for the relevant period, including successful and failed sign-ins, unfamiliar devices or locations, file views or downloads, and changes to sharing permissions. Preserve the original records and timestamps. If logs are unavailable or do not record file-level activity, document that limitation rather than assuming no access occurred.

If a regulated organization holds the data, let its privacy or security team determine whether notification duties apply and whom to notify. HHS states that the HIPAA rule concerns breaches of unsecured protected health information and requires the responsible organization to assess and follow applicable procedures; notification is not automatically required for every stolen phone. Review HHS’s Breach Notification Rule guidance.

What to document for incident response and follow-up

Create a dated record of what happened and the steps taken. Include when and where the phone was last seen, when you discovered it was missing, device identifiers, whether it was locked, and what infant imaging data or accounts it could access. Note each call or report, the organization or person contacted, the time, and any case or confirmation number.

Record remote actions and their results, including location checks, lock or erase requests, SIM suspension, password changes, account session revocation, and access-log reviews. Save relevant screenshots, emails, carrier notices, and police documents in a secure location—not in an account that may still be accessible from the stolen phone. Keep original files where possible and avoid altering logs or messages.

For an organization subject to HIPAA, security incident procedures must include responding to incidents and documenting them and their outcomes. HHS summarizes the Security Rule’s incident-response requirements. Follow your organization’s policies and send the record to its designated privacy or security contact.

In short, lock the phone, report the theft, secure accounts, notify the repository or responsible organization, and preserve evidence. A careful record of what was stored, what protections were active, and what access logs show can help determine the next steps.

FAQs.

Should I remotely erase a phone containing infant scan data?

Consider remote erase if recovery seems unlikely or you believe the data is at immediate risk. First, if practical, use lost-device mode or a remote lock and record any location or account information you may need. Erasing can affect tracking, may wait until the phone reconnects, and does not necessarily delete scans already synced to a cloud repository. If the phone is organization-managed, contact its IT or security team promptly.

How do I report a stolen smartphone using its IMEI number?

Give the IMEI number, phone number, make and model, and theft details to your carrier and local police. Ask the carrier to suspend service and whether it can block the device; request confirmation and keep the police report or incident number. If you do not have the IMEI, check the phone’s packaging, purchase records, carrier account, or device account page.

Who should I contact if infant scans were synced to a cloud repository?

Contact the organization that manages or provided the scans, such as the clinic, hospital, imaging provider, employer, or research organization. If the scans were in a personal cloud account, contact that service too. Ask them to secure access, preserve available logs, review activity, and explain applicable incident-response requirements and notification procedures.

How can I check whether someone accessed the infant scan files?

Ask the repository administrator or cloud provider to review sign-in and file-access records for the relevant period, including views, downloads, unfamiliar devices, and sharing changes. The records available depend on the service and its settings, so a lack of detailed logs does not prove the files were not accessed. Preserve the results and report them to the organization responsible for the data.