Stating the Obvious

While waiting for an elevator during rounds today the following arrived in my email box from Principal Investigator E-Alert:

Reader Question: A month ago I was flying to a convention of my research specialty in San Francisco, and in one of my checked bags was my notebook computer and three discs of raw data (non-encrypted) on about 800 patients we have enrolled in a clinical trial. But the airline lost the bag in transit. Of course, I filed a "lost bag" claim with them, but no trace of it yet. Little hope now. I have heard there is some new law called HITECH that applies to lost data. What should I do at this point? Should I already have done anything?

Expert Comments: Brace yourself, we're going to have to deal with some "alphabet soup" of U.S. government acronyms while explaining your situation.

The Health Information Technology for Economic and Clinical Health Act, or HITECH, is the U.S.A. Federal law that requires you take immediate action and notify those affected by a loss of protected health information (PHI).

First, figure out if HITECH applies. In order for it to come into play, HIPAA (Health Insurance Portability of Accountability Act of 1996) has to apply to you. It does if you're working with patients. However, does HIPAA apply to the particular data you've lost? If you took all of the identifiers off the data, then you're ok because de-identified data isn't covered by HIPAA or HITECH.

View the remainder of the expert comments

Comments by Kristen H. West, J.D., Associate V.P. and Director, Office of Research Compliance, Emory University Atlanta

The expert goes on to more details about the relevant laws and notification requirements- you can follow the link above if you want more. Only the commentary addressed the real issue:

Why would you check a laptop?

1. Laptops are fragile. Don’t let that aluminum exterior fool you; that screen is just waiting to be cracked. Have you watched the way checked bags are handled? Remember those Samsonite commercials when they gave apes at the zoo luggage to destroy? You really want folks to play catch with your computer in a tote bag? Really?
2. Laptops are valuable. Even if it is years old and you have to duct-tape the CD drive closed, someone can pick it up and sell it for a few bucks. Your checked bags have to be accessible to TSA for search; do you really think everyone who touches luggage is immune to thievery? Really?
3. Even in puddle-jumper jets like those by Embraer  you can usually keep your laptop. Roll-aboard bags must be gate-checked, but surely you have a padded tote for the laptop that will fit under the seat in front of you or in those tiny overhead bins. Even when the compartments are filled, the attendants can usually check the tote but tuck your laptop in one of their cubbies during take-off and landing.

My next question:

Why were you traveling with all those data?

1. Planning to work in the airport or on the plane? And you checked your laptop?
2. Planning to work during the meeting? Then why are you going? You are supposed to be meeting- learning, networking, and interacting. Not analyzing your own data in your room.
3. Planning to work in the evening? At a convention of your research specialty in San Francisco? Go out and socialize; the best collaborations in science begin in bars!
4. IRBs require data protection plans. At my institution, we specify that data will be coded and password protected on our servers. Any hard copies will be kept in locked areas accessible only to the PI and other approved personnel. So why did you think taking them on a trip was appropriate?
5. If you absolutely need to access large data sets, invest in some sort of cloud computing. Your institution may be able to set up remote server access for you, and other options are out there. I subscribe to DropBox. Up to 2 Gb can be stored for free, and the applet synchronizes the most recent version with all computers you install it on. Other services also allow you to store files and access them via any internet connection with appropriate security measures.

The bottom line: The scenario described should not have occurred for a whole bunch of reasons. Traveling with a laptop often allows me to accomplish something during delays at O’Hare (as well as sharing my ongoing deep insights with readers of this blog), and I love my Lenovo Ideabook S10 netbook. I would never, never, ever check it!