A home health nurse finishes her last visit, stops for groceries, and comes back to a broken car window. Her work laptop is gone. It had the day's visit notes on it, a cached session to the EHR, and a few exported spreadsheets she meant to delete.
Here is the question her IT team has to answer next: is this a data breach? Most healthcare data security guides would send you straight to ransomware, phishing and network monitoring. Those threats are real, and this guide covers them. But the stolen laptop is a different kind of problem, because the answer doesn't depend on what the thief does. It depends on what you can prove about that device.
Healthcare data security is the set of administrative, physical and technical controls that keep patient information confidential, accurate and available. In practice it covers three layers: who can access patient data, the systems that store and transmit it, and the endpoints (laptops, phones, tablets, workstations) that carry it into exam rooms, homes and cars.
This guide walks through all three, with a closer look at the layer most guides skip: the device that leaves the clinic.
What is healthcare data security?
Clinicians need patient data fast, in many places, on many devices, and every one of those access points is a way in. Healthcare data security is how you keep that data confidential, intact and available anyway: access controls for people, protection for systems and networks, and visibility and control over every device that stores or opens patient records.
Patient data comes in more shapes than the EHR. There's clinical data (diagnoses, notes, imaging, prescriptions), identity data (names, dates of birth, Social Security numbers, insurance IDs), billing data, and research data that may or may not be de-identified. Under HIPAA, all of it counts as protected health information (PHI) when it can be tied to a person.
Why does this matter more in healthcare than elsewhere? Three reasons. First, the data doesn't expire: a leaked diagnosis or insurance ID stays useful to a fraudster for years, which is why it sells well on the dark web. Second, an incident can interrupt care, not just operations. Third, it's expensive. IBM's 2026 Cost of a Data Breach report put the average healthcare breach at $6.64 million, the highest of any industry for the 13th year in a row.
The useful way to think about it is not "how secure are we?" but "where does patient data live right now, and who could prove it's protected?" That second question is where most teams find their first gap.
Where do healthcare data breaches actually start?
Your security plan is only as good as your picture of where incidents begin. Most large healthcare breaches start with hacking: compromised credentials, phishing and ransomware. A smaller but persistent share starts with something physical, like a lost laptop or a stolen phone. Business associates and insiders account for most of the rest.
The numbers lean heavily toward hacking. In 2024, hacking and IT incidents caused 81.2% of large healthcare data breaches, according to The HIPAA Journal's analysis of HHS data. The Change Healthcare ransomware attack that year eventually affected more than 190 million people, the largest healthcare breach on record. It started, as so many do, with a stolen credential on an account without multi-factor authentication.
So why spend time on devices at all? Because the device layer is where IT can most often decide the outcome. A ransomware attack on a billing vendor is largely out of your hands once it's underway. A missing laptop isn't. Whether it turns into a reportable breach depends on controls you set up beforehand and actions you take in the first hours.
That pattern shows up in our own conversations with IT teams. In 2026, about 57% of the 64 Prey demos we analyzed started because a device had been stolen or never returned, and the person on the call usually said some version of the same thing: "all the company data is on it." In healthcare, "company data" means patient records.
Credential theft and device theft also overlap more than they seem. A stolen laptop with a saved browser session is a credential problem too, and leaked staff credentials often show up in criminal markets long before anyone notices. If you want to go deeper on that side, see how stolen clinician credentials end up on the dark web.
Technical safeguards that protect patient data
Technical safeguards are the controls your systems enforce on their own, so they keep working when people are rushed, tired or covering a double shift. Four of them carry most of the weight in healthcare.
Encryption, verified on every device
Encrypt patient data at rest (databases, servers, laptops, phones, backups) and in transit (email, remote access, data exchange). AES-256 is the standard choice, and our guide to types of encryption explains the trade-offs.
The operational catch is the word "verified." Most organizations have a policy that says laptops are encrypted. Far fewer can show, for every device on a given day, that BitLocker or FileVault is actually on and the recovery key is stored somewhere the user can't lose it. That gap matters, because encryption is the control HIPAA rewards most directly (more on that below).
Multi-factor authentication
MFA blocks most credential-based attacks, including the kind that opened the door at Change Healthcare. Turn it on for the EHR, remote access, email, admin portals and every privileged account. Clinicians will push back on friction, so pair MFA with single sign-on where you can, and use phishing-resistant methods (hardware keys or passkeys) for administrators.
Network segmentation and monitoring
Separate networks for medical devices, clinical systems, guest Wi-Fi and administrative systems, so one compromised machine can't reach everything. Add firewalls at the boundaries, intrusion detection, secure VPN or zero-trust access for remote staff, and monitoring that flags unusual data access, such as a user pulling thousands of records at 2 a.m. Keep patching on a schedule, with a testing window for clinical systems that can't go down without notice.
Laptops, phones and tablets that leave the clinic
This is the layer the network can't see. The nurse's laptop from the opening sits outside your firewall most of the day. Here's what protecting it actually involves:
A live inventory: every device that stores or opens PHI, who has it, and when it last connected. A spreadsheet updated at the last audit doesn't count.
Encryption status per device: not "our policy requires encryption," but "this serial number is encrypted, and here's the record."
Location and history: where the device is now, and where it was when it went missing.
Remote lock and remote wipe: the ability to make the device useless and erase its data, even when it's across town. Our guide to remote wipe covers how it works on each operating system.
Fixed-location rules: some devices should never move, like the laptop mounted in an exam room. A virtual boundary (a geofence) can alert you the moment one leaves the building.
Quick wins:
Pull a report of every device that stores patient data and doesn't show encryption as active. Fix those first.
Test a remote lock on one pilot device this week, and time how long it takes to apply.
Write down who a clinician calls when a device goes missing, and put that number on the device itself.
Administrative controls: risk, access, training and response
Technical controls only hold if the people around them know what to do. Administrative safeguards are the policies, processes and habits that make the technology work on a busy day.
Risk assessments
The HIPAA Security Rule requires a risk analysis, and it's the one document every auditor asks for first. A useful one lists where PHI lives (including endpoints), the threats to each location, the controls in place, and what's left to fix. Our IT security risk assessment guide walks through the method. Update it when something changes, not just once a year.
Access controls and offboarding
Give people the minimum access their role needs, review it regularly, and log every access to patient records. The weak point is usually the change: someone switches departments, a contractor's project ends, a physician leaves the practice. Accounts get disabled, but the laptop with cached files may still be sitting in a home office. Pair account deprovisioning with a device step, and use an IT offboarding checklist that covers both.
Training that includes the lost-device call
Phishing simulations are standard now. What's often missing is the lost-device drill. Does a resident know that a missing tablet should be reported right away, not after a weekend of searching? The faster IT hears about it, the more options it has. Make reporting easy and blame-free: people who fear blame wait, and waiting is what turns an incident into a breach.
Incident response planning
You need a written plan with roles, contacts, evidence steps and notification decisions, tested with tabletop exercises. Our guide to creating an incident response plan covers the general structure, and the HIPAA incident response plan guide adds the healthcare-specific steps. Include at least one lost-device scenario, because it will be your most frequent drill in real life.
Quick wins:
Add a device step (lock, recover, wipe) to every offboarding ticket.
Run a 30-minute tabletop on a stolen laptop with your privacy officer in the room.
Set a target time from "device reported missing" to "device locked," and measure it.
Vendors and business associates
Your security now extends to every company that touches your patient data: billing services, transcription, cloud hosting, IT support, even the MSP that manages your laptops. HIPAA calls them business associates, and their breaches become your problem.
Three controls keep this manageable. First, sign a business associate agreement (BAA) with every vendor that handles PHI, spelling out safeguards and breach-reporting duties. Second, do real due diligence before signing: ask for their risk assessment, their encryption practices and their incident history, not just a security questionnaire. Third, limit what each vendor can reach. A billing company doesn't need access to clinical notes.
Your practice manager may not think of the company that services the copiers as a vendor that matters, until you remember those machines have hard drives full of scanned patient forms.
Which HIPAA requirements shape your device controls?
When a laptop goes missing, the compliance officer will ask one question first: was it encrypted? Under the HIPAA Breach Notification Rule, a lost or stolen device holding PHI encrypted to HHS standards is generally not a reportable breach. Unencrypted, it's presumed to be one unless a documented risk assessment shows a low probability of compromise.
That's the encryption safe harbor, and it's the most practical sentence in HIPAA for an IT team. HHS guidance treats PHI encrypted according to NIST standards as "secured," and its ransomware fact sheet gives the exact example: a laptop with full-disk encryption that was properly shut down when it was lost or stolen doesn't require breach notification.
Notice the conditions. Full-disk encryption protects data at rest. A laptop that was running, unlocked or logged in when it disappeared may not qualify, because the data on it was already decrypted. And the decryption key can't travel with the device. Those details are why encryption status and device state are evidence, not just settings.
If the safe harbor doesn't apply, you assess four factors: what PHI was involved, who may have gotten it, whether it was actually acquired or viewed, and how far the risk was mitigated. Location history and a confirmed remote wipe speak directly to the last two. If notification is required, the Breach Notification Rule gives you up to 60 days from discovery to notify affected individuals. Breaches affecting 500 or more people must also be reported to HHS, and to prominent media outlets when more than 500 residents of one state are affected.
The Security Rule ties this together. Beyond administrative and technical safeguards, it includes physical safeguards for devices and media: tracking where hardware goes, and how it's reused or disposed of. If you're choosing tooling to meet those requirements, our guide to MDM for HIPAA compliance goes deeper.
Quick win: for every device class you manage, write down whether the safe harbor would apply if one went missing today, and what evidence you'd show. Wherever the answer is "not sure," that's your next project.
Ransomware, cloud and connected medical devices
Not every risk sits on a laptop, and not every fix is yours to make alone. Your biomedical engineer, your EHR vendor and your backup provider each own part of these three.
Ransomware preparedness. Keep offline or immutable backups, test restores on a schedule, and know which clinical workflows can run on paper for a day. The HHS fact sheet treats a ransomware encryption of PHI as a presumed breach, so containment and evidence matter here too.
Cloud services. Most patient data now passes through cloud EHRs, messaging tools and file sharing. Sign BAAs with cloud providers, turn on their logging, and review who has admin rights. A misconfigured storage bucket exposes data as effectively as a stolen laptop.
Connected medical devices. Infusion pumps, imaging systems and monitors often run old operating systems that can't be patched on your schedule. Keep them on their own network segment, inventory them like any other endpoint, and work with biomedical engineering on update windows.
How do you prove your controls work?
An auditor, an insurer or OCR won't take "we have a policy" as an answer. You prove your controls with records: inventory reports, encryption status logs, access reviews, training completion, incident timelines and the results of your tabletop exercises. That evidence also decides the outcome of every lost-device incident.
Think back to the stolen laptop. Most healthcare teams aren't short on policies. They're short on proof that the policies held on a specific device, on a specific day. Cyber insurers increasingly ask for the same proof at renewal, which makes it a budget conversation as much as a compliance one.
Build the evidence habit into routine work:
Monthly: export your device inventory with encryption status and last connection date. Investigate anything silent for more than 30 days.
Quarterly: review access to patient data and run one tabletop exercise, alternating ransomware and lost-device scenarios.
After every incident: keep the timeline: when it was reported, when it was locked, where it was last seen, and when it was wiped or recovered.
Yearly: update the risk analysis, review vendor BAAs, and use the totals to justify next year's security budget.
Penalties are the backstop, not the reason: most OCR enforcement involves organizations that couldn't produce a risk analysis or basic safeguards when asked.
How do endpoint management tools close the device gap?
Everything above depends on one thing most teams can't do from a spreadsheet: knowing where each device is and what state it's in. Endpoint management tools close that gap by keeping a live inventory, recording encryption status and location, and letting you lock or wipe a missing device remotely. That's the gap Prey was built to fill.
Jackson-Hinds Comprehensive Health Center in Mississippi is a good example. When we wrote up their story, CIO Markeese Robinson was responsible for 120 laptops across 24 locations, including 10 school-based clinics and two mobile clinics. His team had already encrypted every laptop. What they wanted was a second layer: the ability to locate, lock and wipe a device if it went missing. In Robinson's words: "If someone loses a laptop, we can prove we did everything possible to protect the data on it."
That sentence is the whole argument of this guide. Here's how the device layer works in practice with Prey:
Inventory and status: every device, its user, its hardware and software, and when it last connected, across Windows, macOS, Linux, Android, iOS and Chromebook.
Encryption management: BitLocker status on Windows devices, so "encrypted" is a record, not an assumption. It's part of Prey's data protection layer.
Location and history: always-on GPS and Wi-Fi location, plus a history of past locations to reconstruct where a device went.
Remote lock and wipe: lock a missing device right away, then wipe it if recovery isn't realistic.
Control Zones: alerts when a device leaves an area it shouldn't, like the exam-room laptops Robinson plans to fence in.
Recovery Reports: location, screenshots and camera captures packaged as evidence.
Robinson's team also used Prey's reports to catch a quieter problem: a laptop that's been offline longer than normal sometimes means the person using it has left the organization. And when a provider misplaced a laptop before a vacation, the team locked it remotely until it turned up. You can read the full story of one community health center with 24 clinics.
Prey doesn't replace your EHR's access controls or an MDM you already run. Many IT teams run it alongside Microsoft Intune, often because speed matters in a theft: one MSP serving healthcare clients told us a remote wipe in Intune "took 34 minutes to initiate." For a broader view of the category, see what endpoint security covers.
A lost laptop is a question of evidence
Healthcare data security has a lot of moving parts: access, networks, vendors, cloud, medical devices. Most of them depend on decisions made far from your desk. The device layer is different. Whether the nurse's stolen laptop becomes a reportable breach is decided by things you control: whether it was encrypted, whether you knew where it was, and whether you can show you locked or wiped it in time.
So start there. List every device that holds patient data locally, check its encryption status today, and time how long it takes your team to lock one. Those three numbers will tell you more about your real exposure than any policy document.
Frequently asked questions
What is data security in healthcare?
Data security in healthcare is the set of administrative, physical and technical controls that keep patient information confidential, accurate and available. It covers who can access patient data, the systems that store and transmit it, and the devices (laptops, phones, tablets) that carry it outside the facility. In the US, the HIPAA Security Rule sets the minimum requirements.
Why is data security important in healthcare?
Patient data is valuable to criminals for years, a breach can interrupt care, and healthcare breaches are the most expensive of any industry: an average of $6.64 million per IBM's 2026 report. Healthcare organizations also face HIPAA notification duties and OCR enforcement when patient data is exposed.
What is the biggest threat to the security of healthcare data?
Hacking is the biggest threat by volume: it caused 81.2% of large healthcare breaches in 2024, mostly through stolen credentials, phishing and ransomware. Lost and stolen devices are a smaller but persistent source, and they're the incidents an IT team can most often contain with encryption, location tracking and remote wipe.
Is a lost or stolen laptop a HIPAA breach?
Not automatically. If the laptop's data was encrypted to HHS standards and the device was properly shut down, HHS guidance generally treats the PHI as secured and no notification is required. If it wasn't encrypted, the loss is presumed to be a breach unless a documented risk assessment shows a low probability that patient data was compromised.
Can a healthcare data breach affect patient care?
Yes. Ransomware attacks have forced hospitals to divert ambulances, delay procedures and return to paper records for days or weeks. Even smaller breaches can disrupt care when systems are taken offline for investigation. That's why backups, downtime procedures and fast containment belong in a healthcare security plan.
What should you do after a healthcare data breach?
Contain it first: lock or wipe affected devices, reset compromised credentials and isolate affected systems. Then preserve evidence, run the HIPAA risk assessment, and decide on notification: affected individuals must be notified within 60 days of discovery, and breaches affecting 500 or more people must also be reported to HHS.
