Loss of a Single Laptop Leads to $50k Fine Against Idaho Hospice

netbuzz writes "Losing a single laptop containing sensitive personal information about 441 patients will cost a non-profit Idaho hospice center $50,000, marking the first such HIPAA-related penalty involving fewer than 500 data-breach victims. Yes, the data was not encrypted. 'This action sends a strong message to the health care industry that, regardless of size, covered entities must take action and will be held accountable for safeguarding their patients' health information,' says the Department of Health and Human Services."

Comments

Re:Being non-proft does not justify being incompet

[Anonymous Coward]

Question; is there a differance between 'effective' encryption, and 'HIPAA Approved' encryption?

Yes, HIPAA stipulates that it must be FIPS-accredited. AES-encrypted zip files are acceptable; the older standard of zip file encryption (whatever that was) isn't.

What stops your medical records being 'encrypted' with ROT13?

The above.

Re:Being non-proft does not justify being incompet

[Guido69]

FIPS 140-2 to be more specific. There are plenty of free options.