Only after a laptop is stolen from the trunk of a car owned by a researcher at the National Heart, Lung, and Blood Institute (NHLBI) does this organization promise to do better when it comes to security. Why does it always go down this way?According to a statement issued by the NHLBI, a notebook was lifted from the locked trunk of an employee. The good news, as is so often the case, is that the theft appears to be random. That is, the thieves seem to have gone for the hardware, and not for the data it holds. Also, it doesn't appear as if any financial information was stolen, or data that could directly lead to identity theft, such as Social Security numbers or credit card data. What is definitely missing are the health records of roughly 2,500 hundred participants in a cardiac MRI study conducted between 2001 and 2007. The records included name, date of birth, medical record numbers, and MRI data. While this is certainly private information, it's not as bad as many of the breaches due to lax security we've recently witnessed.

I'm not familiar with any law or regulation that requires this breach to be publicly disclosed. It's certainly not covered by California SB 1386, which requires personally identifiable financial information to be exposed to trigger a notification. So kudos to the NHLBI for doing the right thing, and alerting participants who may be affected.

However, it's the promise of future security enhancements that rings hollow. It sounds like the text in so many other breach notifications that have made the news in recent years:

We want to assure the participants in this and every other NHLBI study that we are taking several steps to increase data security and ensure that similar incidents do not occur in the future.

And it continues:

The NHLBI is conducting proper follow-up procedures with those responsible for this incident and has taken several steps to increase data security and protect the privacy of current and future study participants. First, we are ensuring that all NHLBI laptop computers are encrypted, as required by policies of the DHHS and the Office of Management and Budget. Laptop computers in the possession of NHLBI research staff are being inspected by NIH CIT information security personnel to ensure that appropriate encryption software is installed.

The interesting question here is one about organizations and risk. What is it about risk that makes organizations only take these sorts of security-conscious steps after there's a breach?