Lifespan’s stolen laptop and the home office risk analyses missed
OCR’s July 2020 settlement with Lifespan turned on an unencrypted laptop, a weak device inventory and missing agreements. It landed as health care’s administrative staff settled in at home, where HIPAA risk analyses written for hospital buildings had not followed them.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On July 27, 2020, the HHS Office for Civil Rights announced that Lifespan, a Rhode Island health system, had agreed to pay $1,040,000 and adopt a two-year corrective action plan to settle potential HIPAA violations. The case arose from February 2017, when a laptop was stolen from an employee’s car. The laptop was not encrypted and held electronic protected health information. OCR said its investigation found systemic noncompliance. Lifespan had no policy requiring encryption of devices that held patient data, did not adequately track or inventory those devices, and lacked business associate agreements among its affiliated entities. The settlement was announced while much of health care’s administrative workforce, including revenue cycle, coding and scheduling staff, was working from home because of the pandemic.
The Lifespan settlement concerned an incident three years old, but it arrived at a moment that made it newly pointed. By the summer of 2020, health systems had sent large numbers of non-clinical staff home, often quickly and with whatever equipment was available. The HIPAA Security Rule requires covered entities and business associates to conduct an accurate and thorough risk analysis and to manage the risks it finds. Most risk analyses had been written for a workforce inside hospital buildings. The home workforce created three kinds of exposure those analyses rarely covered: organization-issued devices outside the building, personal devices used for work, and patient information that never touches a device. Each needed a different set of controls, and each had to be written into an updated analysis.
Organization-issued devices outside the building
Laptops issued in a hurry in March 2020 did not always meet the organization’s standard. Some were old machines brought out of storage; some were bought wherever supply could be found. Each needed confirmed full-disk encryption, endpoint protection, current patches and remote wipe. Each also needed an inventory record showing who held it and where.
The Lifespan case turned on exactly these basics. Encryption is an addressable implementation specification under the Security Rule. An organization must implement it where reasonable and appropriate, or document why an alternative is adequate. For laptops that leave the building, that argument is hard to make. An accurate inventory is what lets an organization prove encryption is in place, and act fast when a device goes missing. Without one, a single lost laptop can become a breach investigation with no way to show what the device held.
Inventory needs a process as well as a spreadsheet. Devices should be enrolled in management tooling before they ship, so encryption status reports automatically. Returns from departing staff should be tracked to closure. A monthly comparison between the device management console and the asset register flags machines that have stopped checking in. Those are the ones most likely to be lost, stolen or forgotten.
Personal devices used for work
Where organizations could not supply devices, some staff used personal computers to reach virtual desktops, web applications or email. Others used personal phones for work calls, messages and authentication. Each raised questions an updated risk analysis had to answer. Could patient information be stored locally, printed or copied? Could the organization see or control the device’s security state?
Virtual desktops and browser-based access that keep data off the device reduce the exposure considerably, provided downloads, printing and clipboard use are restricted. Mobile device management can apply controls to work data on personal phones without taking over the whole device. Where neither is possible, the organization needs a clear policy on what staff may do, and a documented decision about the residual risk signed by an accountable leader.
Business associates raise the same question at one remove. Billing companies, coding contractors and transcription services also sent staff home. The Lifespan findings on missing agreements are a reminder to confirm that each business associate agreement is in place and current. Organizations should also ask business associates how their remote staff access patient data, since a gap there is still the covered entity’s exposure.
Patient information that never touches a device
The home office exposes information in ways no endpoint control reaches. Staff print documents at home and must dispose of them securely. Calls about patients can be overheard by family members or picked up by smart speakers. Screens can be seen by others in the household. Paper records taken home for convenience can be lost.
These are workforce practices, managed through policy, training and practical support. That support might mean a shredder or a secure disposal service, guidance on where to take calls, privacy screens, or a rule against printing at home except for defined roles. The Security Rule’s physical safeguards and the Privacy Rule’s reasonable safeguards apply wherever the work happens.
Training has to match the setting. Annual HIPAA modules written for hospital corridors say little about a kitchen table shared with family. Short, specific guidance works better. It should cover where to sit for calls, what to do with a printed page, how to lock a screen when someone walks in, and whom to call if a device or document goes missing. Asking staff to confirm their home setup against a brief checklist, and repeating it each year, turns guidance into a record the organization can point to.
All three exposures belong in the risk analysis, which is meant to be revisited when operations change. Moving a large share of the workforce home is such a change. The update should list each exposure, its likelihood and impact, the controls chosen and an owner for each remaining gap, then track the gaps to closure. OCR has repeatedly cited missing or outdated risk analyses in enforcement actions. Organizations should confirm their specific obligations with counsel. The practical step is the same everywhere: rewrite the analysis for how people actually work now.
With hindsight
Remote and hybrid work stayed in place for much of health care’s administrative workforce, and the exposures described here did not go away. OCR kept citing failures to conduct accurate and thorough risk analyses, and in 2024 it launched an enforcement initiative focused specifically on risk analysis, announcing a series of settlements and penalties under it.
The HIPAA Security Rule changes HHS proposed at the end of 2024 would, if finalized, make encryption and a written technology asset inventory explicit requirements with limited exceptions, along with multi-factor authentication. The basics that the Lifespan case turned on would move from addressable to expected. Until then, the existing rule already requires the risk analysis to follow the work.