Lifespan’s stolen laptop and the home office risk analyses missed

The week

On July 27, 2020, federal regulators announced a settlement with Lifespan, a Rhode Island health system, over a case that began the way many data breaches do, with a car, a laptop and a moment of bad luck rather than a sophisticated hacker. In February 2017, a Lifespan laptop was stolen from an employee’s car. It was not encrypted, and it held electronic protected health information.

Lifespan reported the theft to the HHS Office for Civil Rights in April 2017. According to OCR, the laptop held patients’ names, medical record numbers, demographic information and medication information, for more than 20,000 people. The settlement came more than three years after the theft, which is a typical span for an OCR investigation that ends in a resolution agreement.

Electronic protected health information, often shortened to ePHI, is the legal term for patient information held in digital form: names, diagnoses, treatment details, billing records and similar data that links a person to their care. HIPAA, the federal law that governs how that information is protected, sets rules for health care providers, health plans and the companies that work for them.

The HHS Office for Civil Rights, which enforces HIPAA, said Lifespan had agreed to pay $1,040,000 and adopt a two-year corrective action plan to settle potential HIPAA violations. A corrective action plan is a set of improvements the organization commits to make, with the regulator checking on progress, a form of supervised repair.

The settling party was formally the Lifespan Health System Affiliated Covered Entity. HIPAA lets legally separate covered entities under common ownership or control designate themselves as a single affiliated covered entity. They can then share one set of HIPAA policies, one risk analysis and one compliance program. Lifespan’s hospitals in Rhode Island were organized this way. The arrangement is efficient, and it means that a gap in the shared program is a gap across every affiliate at once.

Like most OCR resolution agreements, the settlement resolved potential violations without a finding of liability. In exchange, the organization accepts a payment and a corrective action plan, and OCR closes its investigation. The alternative path, a civil money penalty imposed by OCR, is rarer and can be contested before an administrative law judge.

The stolen laptop was the trigger, but it was not the whole story. OCR said its investigation found systemic noncompliance. Lifespan had no policy requiring encryption of devices that held patient data, did not adequately track or inventory those devices, and lacked proper business associate agreements between its parent company and its affiliated providers. A business associate agreement is the contract HIPAA requires whenever one organization handles patient information on behalf of another, setting out how that information will be protected.

OCR also said that Lifespan had determined that encrypting laptops was reasonable and appropriate, and then had not done it. Under the Security Rule, that is the weakest position an organization can be in. It had made the risk decision itself, on the record, and not followed through.

The case was one of a long line. OCR had pursued unencrypted portable devices for years. In 2017 it imposed a $3.2 million civil money penalty on Children’s Medical Center of Dallas over lost unencrypted devices. In 2018 an administrative law judge upheld a $4.3 million penalty against the University of Texas MD Anderson Cancer Center over a stolen laptop and lost thumb drives. Lifespan was a familiar fact pattern, and the regulator’s expectations were well established.

The regulator was less interested in the theft itself than in what it revealed: no rule that laptops be encrypted, no reliable list of which laptops existed, and missing paperwork about who was responsible for the data.

The timing gave the case extra weight. The settlement was announced while much of health care’s administrative workforce, including revenue cycle, coding and scheduling staff, was working from home because of the pandemic. Revenue cycle staff handle billing and payment; coders translate care into the standardized codes used for billing. These are people who work with patient information all day, and in the summer of 2020 they were doing it from kitchen tables and spare rooms, on equipment issued in a hurry.

Regulators had already adjusted some rules for the pandemic. In March 2020, OCR announced that it would not penalize providers for good faith use of everyday video applications for telehealth, even if those applications did not fully comply with HIPAA. That notice covered telehealth during the public health emergency. It did not relax the Security Rule for the laptops and remote access used by billing, coding and scheduling staff. The Lifespan settlement was a reminder, in the middle of that shift, that the basics still applied in full.

The Lifespan settlement concerned an incident three years old, but it arrived at a moment that made it newly pointed. By the summer of 2020, health systems had sent large numbers of non-clinical staff home, often quickly and with whatever equipment was available. A risk that had once meant a laptop left in a car now applied to thousands of employees working from home every day.

The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough risk analysis and to manage the risks it finds. Covered entities are the providers, health plans and clearinghouses HIPAA directly regulates; business associates are the vendors and contractors who handle patient information for them. Most risk analyses had been written for a workforce inside hospital buildings. The home workforce created three kinds of exposure those analyses rarely covered: organization-issued devices outside the building, personal devices used for work, and patient information that never touches a device. Each needed a different set of controls, and each had to be written into an updated analysis.

The three exposures are distinct because the controls that work for one do nothing for the others. Device encryption protects a laptop and says nothing about a family computer used to reach a web portal. Virtual desktops keep data off personal machines and do nothing about a printed page or an overheard call. Policy and training reach paper and conversations, and cannot prove that a laptop is encrypted. An analysis that treats “remote work” as one risk will pick one control and leave the other two exposures open.

Inside a HIPAA risk analysis

A risk analysis sounds bureaucratic, but the idea is simple. It is a structured answer to three questions: where patient information lives and travels, what could go wrong with it, and what the organization is doing about each risk. It works like a home inspection for data: the inspector walks through every room, notes the frayed wiring and the loose railing, rates how serious each problem is, and the owner decides what to fix first.

The Security Rule does not hand organizations a checklist of exact technologies. It sets out safeguards, some required and some called addressable, and expects each organization to choose controls that fit its risks. That flexibility is deliberate, because a large hospital system and a three-doctor practice face very different realities. But it puts weight on the risk analysis. It is the document that explains why the organization made the choices it did. If the analysis is missing, out of date or describes a world that no longer exists, the organization’s choices lose their justification.

Required, addressable and the record in between

The mechanics matter for the Lifespan case. Risk analysis and risk management are required implementation specifications: every covered entity and business associate must do them. Encryption of stored data is addressable. So is device accountability, the specification under the device and media controls standard that asks organizations to keep a record of the movements of hardware and electronic media and the person responsible for each.

For an addressable specification, the organization has three choices. It can implement the specification. It can implement an equivalent alternative. Or it can document why neither is reasonable and appropriate for its environment. Each choice must flow from the risk analysis. According to OCR, Lifespan had concluded that encryption was reasonable and appropriate, and then did not implement it. That combination left it with neither the control nor a documented reason for going without.

Methods and tools for doing the analysis

The Security Rule does not prescribe a method, but the main reference points are well known. OCR published guidance on risk analysis in 2010. NIST’s guide to implementing the Security Rule, Special Publication 800-66, lays out the process in detail. HHS and the Office of the National Coordinator for Health IT offer a free Security Risk Assessment Tool aimed at small and medium-sized providers. Large systems often use commercial governance platforms or frameworks such as the NIST Cybersecurity Framework and map them back to HIPAA.

The method matters less than three features of the output. It should be enterprise-wide, covering every location and system that holds electronic patient information. It should be based on facts about how the organization operates now. And it should drive a risk management plan with owners and dates. OCR’s enforcement record shows that analyses limited to one system, or that never led to action, do not satisfy the rule.

That is why the analysis is meant to be revisited when operations change. A risk analysis written when everyone worked on hospital premises, behind hospital locks, on hospital networks, says little about a coder working at home on a laptop that travels in a backpack. The building had changed; the inspection had not.

In practice, a good risk analysis is a team effort. The privacy or compliance officer usually owns the document, but the facts come from many places: IT knows which devices exist and how they are configured, department managers know how their staff actually work, procurement knows which vendors handle patient data, and human resources knows who has joined and left. An analysis written by one person from memory will miss things that any of these groups could have told them in an afternoon.

The output should be practical rather than encyclopedic. A long list of theoretical threats is less useful than a clear table of real exposures, each with a rating, a chosen response and a named owner. That table becomes the organization’s work plan, and the record of how that plan was carried out becomes its best evidence if a regulator ever asks.

Organization-issued devices outside the building

Laptops issued in a hurry in March 2020 did not always meet the organization’s standard. Some were old machines brought out of storage; some were bought wherever supply could be found. Each needed confirmed full-disk encryption, endpoint protection, current patches and remote wipe. Each also needed an inventory record showing who held it and where.

Some organizations went further in the rush and let staff take office desktop computers home. Those desktops had often been configured on the assumption that they would stay in locked buildings, so they lacked encryption and sometimes lacked remote management altogether. Desktops at home are less likely to be stolen from a car than laptops. They are just as exposed to burglary, to family use and to a broken disposal process when they come back.

Those terms are worth unpacking. Full-disk encryption scrambles everything stored on the laptop, so that a thief who removes the hard drive sees only gibberish without the key. Endpoint protection is security software running on the device itself, the modern successor to antivirus, watching for malicious activity. Patches are the updates software makers release to fix security flaws; a laptop that has missed months of patches is exposed to flaws that are already publicly known. Remote wipe lets the organization erase a lost device over the internet the next time it connects.

The Lifespan case turned on exactly these basics. Encryption is an addressable implementation specification under the Security Rule. An organization must implement it where reasonable and appropriate, or document why an alternative is adequate. “Addressable” does not mean optional; it means the organization must either do it or write down a sound reason for doing something else that works as well. For laptops that leave the building, that argument is hard to make.

Why encryption changes the outcome of a theft

Encryption matters for a second reason, in the Breach Notification Rule. HIPAA requires notice to affected individuals, and to HHS, when unsecured protected health information is breached. Smaller breaches can be logged and reported to HHS once a year. Breaches affecting 500 or more people must be reported within 60 days, generally require notice to prominent media outlets, and appear on OCR’s public breach portal. HHS guidance says that information encrypted consistent with NIST standards, with the key kept separate, is not “unsecured”.

The consequence is stark. The same theft from the same car produces two different events depending on one setting. With validated full-disk encryption and the key protected, the organization records a security incident, documents why the data was secured and moves on. Without it, the organization must notify thousands of patients, report to HHS, possibly notify the media and expect an investigation. Few controls change the legal character of an incident so completely.

Encryption that can be proven

Encryption only helps if the organization can show it was on at the moment of loss. That needs central reporting of encryption status from each device, recovery keys stored centrally so locked-out users can be helped without disabling protection, and records kept long enough to answer a question months later. Full-disk encryption protects a device most strongly when it is shut down. A laptop left asleep may hold its key in memory, which is one reason policies often require shutting down before travel.

There are trade-offs. Encryption adds help desk calls when users forget passwords or hardware changes trigger recovery prompts. Pre-boot authentication, which asks for a PIN before the operating system starts, adds friction for staff who share devices. Most organizations accept these costs for laptops, and the decisions about where to draw the line belong in the risk analysis.

An accurate inventory is what lets an organization prove encryption is in place, and act fast when a device goes missing. Without one, a single lost laptop can become a breach investigation with no way to show what the device held. Suppose an employee reports a stolen laptop. With a good inventory, the security team can say within minutes which machine it was, that it was encrypted, when it last checked in and that a wipe command has been sent. Without one, they are left guessing, and so is the regulator.

Inventory needs a process as well as a spreadsheet. Devices should be enrolled in management tooling before they ship, so encryption status reports automatically. Device management tooling is software that lets the IT team see and control every enrolled laptop from one console: whether it is encrypted, patched, and when it last connected. Returns from departing staff should be tracked to closure. A monthly comparison between the device management console and the asset register flags machines that have stopped checking in. Those are the ones most likely to be lost, stolen or forgotten.

Two further measures show whether the device program works. One is the time from a staff report of a lost device to a wipe command and a determination about the data. The other is how quickly departing staff return equipment, which in a remote workforce depends on shipping, courier arrangements and follow-up by managers. A device that is never returned is effectively lost, and should be treated the same way.

Personal devices used for work

Where organizations could not supply devices, some staff used personal computers to reach virtual desktops, web applications or email. Others used personal phones for work calls, messages and authentication. Authentication here means proving who you are when logging in, for example by receiving a code on your phone.

Each raised questions an updated risk analysis had to answer. Could patient information be stored locally, printed or copied, and could the organization see or control the device’s security state? A family computer shared with teenagers, running old software, with no encryption, is a very different risk from a managed corporate laptop.

The Security Rule’s duties attach to the organization, not to the hardware. Electronic patient information on an employee’s personal device is still the covered entity’s responsibility. The risk analysis must cover it whether or not the policy permits it, because the question is what staff actually do.

Virtual desktops and browser-based access that keep data off the device reduce the exposure considerably, provided downloads, printing and clipboard use are restricted. A virtual desktop is a computer that runs in the organization’s data center or cloud; the employee’s own device only shows a picture of the screen and sends keystrokes back. If downloads and copying are switched off, patient information never lands on the personal machine.

What virtual desktops solve, and what they leave open

Virtual desktops close the largest gap, data stored on the device, and leave smaller ones. Malware on an unmanaged personal computer can still capture keystrokes and screen contents. A user can still photograph the screen with a phone. Session timeouts, watermarks on the virtual screen and device checks before access is granted reduce these risks. Device checks, sometimes called posture checks, confirm that the connecting machine has a supported operating system and running security software. Conditional access policies can then allow full access from managed devices and restricted access from personal ones.

Capacity is the other constraint. Virtual desktop infrastructure in 2020 was sized for a minority of remote users. Moving hundreds of billing and coding staff onto it at once strained licensing, servers and network links, and some organizations opened web portals with fewer restrictions as a stopgap. Stopgaps of that kind are exactly what an updated risk analysis should find and schedule for closure.

Mobile device management can apply controls to work data on personal phones without taking over the whole device. Modern tools can create a separate, protected work area on a phone, so the organization can secure or erase work email and apps without touching personal photos and messages. Where neither is possible, the organization needs a clear policy on what staff may do, and a documented decision about the residual risk signed by an accountable leader. Residual risk is whatever risk remains after controls are applied; signing it off makes someone explicitly responsible for accepting it.

Phones, messaging and multi-factor authentication

Personal phones raise their own questions. Staff who text colleagues about patients through consumer messaging apps create copies of patient information outside any managed system. Secure messaging platforms address this, but only if they are easier to use than the alternative. Phones are also the most common second factor for authentication. Some staff object to installing work apps on personal devices, and organizations have responded with hardware tokens for those who decline, or stipends for those who agree. Each approach has a cost, and the risk analysis should record the decision.

How the answer differs by type of organization

A large health system usually has device management, virtual desktops and a security team, and its gaps are about scale and stragglers. An ambulatory network of physician practices often runs on a mix of practice-owned and personal equipment, with IT support from a managed service provider. Its gaps are more basic: devices that were never inventoried, and practice managers who do not know which staff work from home. A small practice may have no IT staff at all, and depends on its electronic health record vendor’s hosted service and on a few simple controls.

Business associates vary even more. A national billing company may have controls stronger than its clients’. A small coding contractor may have sent its staff home with personal laptops and no management. Health plans have their own remote workforces handling claims and member services. Public bodies add one more variant. A county that runs a public health clinic may be a hybrid entity under HIPAA, with only its health care components covered. Remote staff in those components carry HIPAA duties that colleagues in other county departments do not, and policies need to reflect the difference.

Business associates raise the same question at one remove. Billing companies, coding contractors and transcription services also sent staff home. The Lifespan findings on missing agreements are a reminder to confirm that each business associate agreement is in place and current. Organizations should also ask business associates how their remote staff access patient data, since a gap there is still the covered entity’s exposure.

Patient information that never touches a device

The home office exposes information in ways no endpoint control reaches. Staff print documents at home and must dispose of them securely. Calls about patients can be overheard by family members or picked up by smart speakers. Screens can be seen by others in the household. Paper records taken home for convenience can be lost.

Equipment coming back from homes is a further exposure. The Security Rule’s specifications for disposal and media re-use are required, not addressable. Laptops returned by departing staff, failed drives replaced by a courier repair service and home printers that store recent jobs in memory all need a defined path. NIST’s guidance on media sanitization describes methods for clearing and destroying data, and the records of that work belong with the inventory. When thousands of devices went home in a few weeks, the return flow months later was often handled with far less care than the outbound one.

Home printers deserve a specific decision. Some roles need to print. Many do not, and allowing printing for everyone because a few need it creates paper that must be stored, carried and shredded in ordinary homes. A role-based rule, enforced in the virtual desktop or print settings where possible, keeps the volume of paper down.

These are workforce practices, managed through policy, training and practical support. That support might mean a shredder or a secure disposal service, guidance on where to take calls, privacy screens, or a rule against printing at home except for defined roles. The Security Rule’s physical safeguards and the Privacy Rule’s reasonable safeguards apply wherever the work happens.

Calls, video and the telehealth exception

Clinical staff working from home raised a related issue. OCR’s March 2020 enforcement discretion allowed good faith use of non-public-facing video applications for telehealth. It did not allow public-facing ones, such as streaming platforms. It also left the Privacy Rule’s reasonable safeguards in place, so a clinician still needed a private space and care about who could overhear. Organizations that used the discretion well treated it as a temporary bridge, and recorded which tools were in use so they could be replaced when the discretion ended.

Reporting from a kitchen table

Remote work also changes how incidents are found. The Breach Notification Rule treats a breach as discovered on the first day it is known, or reasonably should have been known, to any workforce member other than the person who committed it. The 60-day clock for notifying individuals runs from that point. A home worker who waits a week to report a lost laptop, or a misdirected document, consumes part of the organization’s time without anyone else knowing. Simple reporting routes, a clear message that prompt reporting is expected and will not be punished, and a help desk that knows how to route privacy incidents all shorten the delay.

Training has to match the setting. Annual HIPAA modules written for hospital corridors say little about a kitchen table shared with family. Short, specific guidance works better. It should cover where to sit for calls, what to do with a printed page, how to lock a screen when someone walks in, and whom to call if a device or document goes missing. Asking staff to confirm their home setup against a brief checklist, and repeating it each year, turns guidance into a record the organization can point to.

Rewriting the analysis after a rushed move home

Suppose a regional health system sent several hundred billing, coding and scheduling staff home in a matter of days. Months later, the compliance officer opens the risk analysis and finds it describes desktops bolted to hospital desks.

The update starts with facts. The IT team compares the device management console with the asset register and finds a few dozen laptops that were issued in the rush but never enrolled, so nobody can confirm whether they are encrypted. A survey shows some staff are reaching the billing system from personal computers through a web portal that allows downloads. Several coding contractors have sent their own staff home, and one business associate agreement turns out to have lapsed.

Each finding becomes a line in the updated analysis, with a likelihood, an impact, a chosen control and an owner. The unenrolled laptops are recalled or enrolled within a set period. The web portal is switched to a virtual desktop with downloads and printing disabled. The lapsed agreement is renewed, and each contractor is asked to describe how its remote staff reach patient data. Home workers receive a short checklist on calls, screens and paper, with a shredder provided for the few roles that must print. Every open item is tracked until it is closed.

The fixes had costs. Recalling unenrolled laptops took coders offline for a day each, and the revenue cycle team pushed for a staggered schedule, which the compliance officer accepted with a firm end date. Moving the billing portal to virtual desktops required more licenses and exposed latency problems for staff on rural broadband. One coding contractor resisted questions about its remote staff, citing its own confidentiality. It agreed to an annual attestation and a summary of its controls when its agreement was renewed. Each of these decisions was written into the analysis, with the reason and the person who accepted any remaining risk.

Nothing in this list is exotic. It is the ordinary discipline of knowing what you have, protecting it and writing down why. That is precisely what the Lifespan settlement found missing.

Payments, supervision and trust

All three exposures belong in the risk analysis, which is meant to be revisited when operations change. Moving a large share of the workforce home is such a change. The update should list each exposure, its likelihood and impact, the controls chosen and an owner for each remaining gap, then track the gaps to closure. OCR has repeatedly cited missing or outdated risk analyses in enforcement actions.

The stakes are financial, operational and reputational. A settlement brings a payment and years of supervised remediation. A corrective action plan means reporting to the regulator, adopting and documenting new policies, training staff and demonstrating progress, all of which draws on the time of people who have other jobs to do. A breach brings notification to patients, investigation costs and staff time diverted from the work they were hired to do.

The reputational stakes are the hardest to measure and the easiest to underrate. Patients who learn that their records sat on an unencrypted laptop in a car do not distinguish between a technical lapse and a lack of care. Health care runs on trust, and a story about a stolen laptop is easy for anyone to understand, which is exactly why it travels.

There is also a less visible cost: the gap between how leaders think the organization works and how it actually does. When the risk analysis describes a hospital building and the work happens in hundreds of homes, decisions about budgets, tools and training are being made against an imaginary picture. Updating the analysis is as much about giving leadership an accurate view as it is about satisfying a regulator.

How an OCR investigation actually proceeds

Most OCR investigations begin with a complaint or a breach report. For breaches affecting 500 or more people, OCR routinely opens a compliance review. Investigators typically ask for the risk analysis, the risk management plan, and policies and procedures. They also ask for evidence of the controls in place at the time of the incident, the device inventory, business associate agreements and training records. They compare what the organization says it does with what the documents show.

Many investigations close with technical assistance, where OCR explains what needs to change and the organization makes the fix. A smaller number end in a resolution agreement or a civil money penalty. The deciding factors are usually how long the problem persisted, whether the organization knew about it and whether it had already acted. An organization that can show a current analysis, documented decisions and work under way is in a far stronger position than one that starts assembling those records after the letter arrives.

Penalty amounts are bounded by statute and by culpability tier. In 2019 HHS announced that it would apply lower annual caps for the less culpable tiers, as a matter of enforcement discretion. The tiers run from violations the organization did not know about, through reasonable cause, to willful neglect that was or was not corrected. An organization that decided encryption was appropriate and then did not implement it is closer to the wrong end of that range.

The good news is that the controls involved are well understood and widely available. Encryption is built into modern laptop operating systems. Device management, virtual desktops and mobile device management are mature products. Practical home-office safeguards cost little. What is usually missing is not technology but ownership, follow-through and a document that ties it together.

The case against rewriting the analysis

A fair objection is that enforcement for unencrypted devices proved weaker than it looked. In January 2021, the Fifth Circuit Court of Appeals vacated the $4.3 million penalty against MD Anderson. The court held, among other things, that the encryption standard did not require a perfect outcome and that the penalty was arbitrary. A compliance officer could read that as evidence that the regulatory risk of a lost laptop is overstated.

The ruling turned on the wording of specific provisions and on how OCR had applied and calculated that penalty. It did not touch the Breach Notification Rule, which still requires notice when unsecured information is lost. It did not make unencrypted laptops safe. And OCR continued to settle cases on the basis of missing or inadequate risk analyses, which is the obligation at the center of this article.

A second objection is that remote work can be safer than the office. A coder on a well-run virtual desktop, with no paper and no local data, may carry less risk than one in a shared office with printouts on the desk. That can be true. The risk analysis is where to show it, with evidence. The claim cannot simply be assumed.

A third objection is cost for small organizations. A three-doctor practice cannot run a security operations center. It can turn on the encryption built into its operating systems and keep a list of its devices. It can use its record vendor’s hosted service from managed machines, and spend an afternoon updating its analysis with the free HHS tool. The rule scales its expectations to the organization, and the core steps are within reach of almost everyone.

The controls that close the gaps

The health systems in good shape share a profile. Every device that holds patient data is encrypted, enrolled in management tooling before it reaches an employee and reconciled monthly against the asset register. Personal devices can reach patient data only through channels that keep it off the device. Every business associate agreement is current, and vendors have been asked how their own remote staff work. Home workers have specific guidance and the equipment to follow it. And the risk analysis describes the organization as it actually operates, with an owner and a date against every open gap.

The evidence trail matters as much as the controls. An investigator will want to see encryption status reports from the time of an incident and the inventory record for the device. The date the analysis was last updated, and the business associate agreement for any vendor involved, will follow. Organizations that produce those records routinely, as part of monthly operations reporting, can answer within days. Simple metrics keep the program honest. Useful ones include the share of devices reporting encryption in the past week and the age of the risk analysis. Others are the share of business associate agreements reviewed in the past year and the number of open risk items past their due date.

The failures are familiar:

• Reading “addressable” as “optional.” The rule expects encryption or a documented, equivalent alternative.
• An inventory nobody reconciles. A list that is never compared with reality cannot prove anything when a device goes missing.
• Ignoring personal devices. If staff use them, they are part of the risk, whether or not policy says so.
• Forgetting the vendors. Business associates have home workers too, and their gaps become the organization’s exposure.
• Training for the wrong room. Guidance written for hospital corridors does not help at a shared kitchen table.
• A frozen risk analysis. The analysis is meant to change when the work changes.

Exactly what the rule requires of a particular covered entity is a question for its lawyers, but the practical step is the same everywhere: rewrite the analysis for how people actually work now.

A remote-work risk analysis covers laptops, downloads and vendors

1. When was our HIPAA risk analysis last updated, and does it describe how our staff actually work today?
2. How many laptops do we have outside our buildings, can we prove each one is encrypted, and which have stopped checking in to the device management console?
3. Can patient information be downloaded, printed or copied onto personal devices, and where is that blocked and where is it not?
4. Is every business associate agreement in place and current, and do we know how our vendors’ remote staff reach our data?
5. If an employee reported a stolen laptop this afternoon, how quickly could we say what was on it and whether it was protected?

With hindsight

Remote and hybrid work stayed in place for much of health care’s administrative workforce, and the exposures described here did not go away. OCR kept citing failures to conduct accurate and thorough risk analyses, and in 2024 it launched an enforcement initiative focused specifically on risk analysis, announcing a series of settlements and penalties under it.

The legal backdrop moved in several directions. In January 2021, Congress amended the HITECH Act to reward recognized security practices, such as the NIST Cybersecurity Framework or the 405(d) practices. HHS must now consider whether an organization had them in place for the prior 12 months when deciding fines and audit outcomes. That gave organizations a direct incentive to document their programs. The same month, the Fifth Circuit vacated the MD Anderson penalty, which narrowed how OCR could frame cases built on lost devices alone.

The pandemic exceptions ended. The public health emergency closed on May 11, 2023, and OCR’s telehealth enforcement discretion expired with it, after a transition period that ran into August. Organizations that had treated the discretion as temporary had less to unwind.

Remote access became the central risk in the largest health data breach on record. In February 2024, attackers entered Change Healthcare, a UnitedHealth Group subsidiary, through a remote access portal that lacked multi-factor authentication, according to the company’s chief executive in testimony to Congress that May. UnitedHealth later estimated that around 190 million people were affected. The case concerned a business associate’s systems, and it showed how much of health care’s exposure lies in the remote access paths that the 2020 move home multiplied.

Guidance kept pace. NIST revised its HIPAA Security Rule implementation guide in February 2024. HHS published voluntary cybersecurity performance goals for the health sector in January 2024, including strong encryption and multi-factor authentication among the essential goals.

The HIPAA Security Rule changes HHS proposed at the end of 2024 would, if finalized, make encryption and a written technology asset inventory explicit requirements with limited exceptions, along with multi-factor authentication. Multi-factor authentication means requiring something beyond a password, such as a code on a phone, before granting access. The basics that the Lifespan case turned on would move from addressable to expected.

The proposal went further than encryption. It would require a written technology asset inventory and a network map, reviewed at least once a year. It would also require vulnerability scanning at least every six months, penetration testing at least annually and the ability to restore critical systems within 72 hours. Several of these turn the remote work controls described in this article into explicit, auditable obligations.

The final rule did not arrive on schedule: by July 2026, OCR’s regulatory agenda had pushed final action to 2027. Until then, the existing rule already requires the risk analysis to follow the work.

The case now reads less like a story about one stolen laptop and more like an early marker of where enforcement was heading. The regulator’s attention settled on the same foundations again and again: an accurate risk analysis, encryption, an inventory of devices and clear agreements with the organizations that handle patient data. A dedicated enforcement initiative on risk analysis, and a proposed rule that would turn encryption and inventory into explicit requirements, both point the same way.

Waiting for the final rule is the wrong instinct. The proposed changes largely describe what good practice already looked like in 2020. An organization that knows where its devices are, encrypts them, keeps patient data off personal machines and updates its risk analysis when work changes will have little to do when the rule arrives, and much less to explain if a laptop goes missing before then.