Recently, it was reported that probation files in the custody of a probation officer were stolen (along with the officer’s car in which the files were left). Those records were later recovered (along with the car). Whether records or information is stolen, or simply lost, this is a reminder of a real risk that litigators face. We frequently are traveling to and from depositions, meetings, hearings and the like. We also frequently transport paper or electronically stored confidential or sensitive information along with us.
While remote access and paperless offices may make it less likely that we have with us physical paper copies of records, losing electronic devices still presents the risk of passwords being hacked and stolen. I recently read a short article about what to do if you lose a laptop. It provides a few common sense tips for protecting your electronic information.
As for losing someone’s medical records everyone probably first thinks about potential HIPAA violations. The first analysis must be made as to whether you are a covered entity. In the context of a personal injury case, where records are obtained from opposing counsel or via a subpoena, most lawyers in possession of medical records would not be considered a covered entity. If you are not a covered entity (or a business associate of a covered entity) HIPAA would not apply.
There could, however, be other important privacy concerns and state laws that you should consider. For example, Nebraska has the Financial Data Protection and Consumer Notification of Data Security Breach Act of 2006, Neb.Rev.Stat. §87-801 et. seq. I will delve into that Act in a later post.
Obviously, if you lose confidential or sensitive material you should inform the potentially affected parties as soon as practicable and take steps to recover the stolen or lost information.