2

Read assigned case study and answer questions based on your knowledge you have learned throughout the course. CYBERCRIME CASE STUDY 2: The Stolen Hospital Laptop Scenario: A health care system executive left their work-issued laptop, which had access to over 40,000 medical records, in a locked car while running an errand. The car was broken into, and the laptop stolen. The Crime: Physical theft of an unencrypted device. The Response: The employee immediately reported the theft to the police and to the health care system's IT department who disabled the laptop's remote access and began monitoring activity. The laptop was equipped with security tools and password protection. Data stored on the hard drive was not encrypted-this included sensitive, personal patient data. The hospital had to follow state laws as they pertain to a data breach. The U.S. Department of Health and Human Services was also notified. Personally Identifiable Information (PIl) and Protected Health Information (PHI) data require rigorous reporting processes and standards. After the theft and breach, the health care system began an extensive review of internet policies; they created a discipline procedure for employees who violate security standards. A thorough review of security measures with internal IT staff and ancillary IT vendors revealed vulnerabilities. Impact: The health care system spent over $200,000 in remediation, monitoring, and operational improvements. A data breach does impact a brand negatively and trust must be rebuilt. 1. What lessons were learned from this incident? 2. Knowing how the hospital responded, what would you have done differently? 3. What are some steps you think the hospital could have taken to prevent this incident