Lost drive? So what?

The drive was securely encrypted and data further encrypted/obfuscated to frustrate any attempts at unauthorised recovery.

They only have to worry if their procedures were so lax as to allow someone to attach a generic drive (unencrypted) and to copy the data over in the clear.

And only total amateurs would allow such a thing to happen, professionals dealing with vast amounts of sensitive information would be experts at handling such information securely.

Err....yeah....

Right....

Ad-hoc encryption (just write it into your procedures) is a piece of piss, has no real overhead and is better than nothing (just try TrueCrypt if you don't believe me).

System-wide encryption is harder but still doable and is certainly cheaper than having your ass sued off when (not "if", "when"!) you lose the data vessel.

There is no excuse for sensitive data of any kind leaving a facility in the clear other than gross incompetence/negligence.

Perhaps the USA would like some advice from the UK government on data securty?

Oh...wait a minute...

Could not happen in the UK

No one would have that much accountability.

Ultimately *only* a hit to the wallet makes corporations pay attention. Truecrypt anyone?

Thumbs up but only for the kicking.

Software

Health Net said the data could only be viewed with specific software, but unfortunately that software was commonly available.

so that's Adobe Reader then.

Fail

The need for encrypting data before it leaves the location is common knowledge to any IT jocky (note, I did not use "pro") in the industry. What all is explicitly stated in HIPAA may be unknown to a fair portion, but the general sense is quite obvious: use secure passwords, use encrypted channels of communications, encrypt portable data, etc, etc. This company obviously did not follow such common guidelines, let alone a HIPAA mandate. Also, the only user in an organization that would have need for 1.5mil records is either an IT person, or someone who needed an IT person to get it... (think upper-management or research/development)

Just plain fail.

Your data is not secure

I can still log into any server at my old employer (a hospital). The NT account had permissions on all the servers (over 150), Citrix remote gateway access and admin rights on all servers. The user name and password are most certainly not complex, single words out of the dictionary with no caps or special characters. The password also never expires and was never changed in the four years I worked there. It would commonly be viewed as a weak password. And this was not some Podunk rural hospital, we were the only level one trauma center in the area and served thousands of patients a day. Your data is most certainly NOT secure and anyone who believes it is fooling themselves. I hate to be the chicken little type but this is just one real world example. When companies only view IT as an expense and don't invest properly in their infrastructure stuff like this happens.