If you use a smartphone to send or receive ePHI, the following instructions explain how you can confirm it is secured:
If you have had data stolen, lost data, had a device with data stolen on it, or believe that an individual has broken into your computer, please follow the instructions below.
Notify Yale IMMEDIATELY of all events that might be potential breaches of confidential information.
Yale HIPAA professionals will work with you to determine the next steps, and whether the event requires notification. Other incidents involving Yale data should be reported immediately to: email@example.com.
Disconnect it from the network and using a different computer, contact the Information Security Office immediately, by contacting the Help Desk at: firstname.lastname@example.org. Information Security will investigate the incident and help you recover your system. When reporting a possible intrusion, it is helpful if you can provide the following information:
If you need to report lost or stolen electronic media or a computing device, please follow the steps below.
Notify local law enforcement where the laptop was stolen (e.g. Yale Police Department, Prince George's County Police Department, etc.). Be sure you get the case number and primary police contact for the case.
In order to document whether confidential/sensitive data may have been exposed, if it was exposed, and what data was exposed, first consider what kind of information was stored on your computer or device.
Determine if any data belonging to other organizations, corporations, or agencies (e.g. Federal, state or non-profits such as the VA or Yale New-Haven Hospital) were stored on the device.
If you have an ITS network backup account or a backup CD or DVD, you may be able to review the information stored on the device at the time of the last backup by reviewing the backup.
Fill out the Lost/stolen electronic media or computing device form and then send the form via email to the Information Security Office at email@example.com ASAP.
Change any passwords you believe may have been used, stored, or saved in memory on the computer or mobile/storage device.
If you stored any confidential data, such as credit card or bank account numbers on the computer or mobile/storage device, you should notify the affected institutions. See the following resources if you believe that your identity has been compromised.
If the computer or device was registered with the Yale University S.T.O.P. program (Security Tracking of Office Property) provided by the Yale Department of Public Safety, call (203) 432-OPEN (6736).
STOP isn't a tracking device like LoJack, but is a prominent, permanently affixed identification plate that labels the laptop as Yale property.
If you enrolled your device in one of their programs, such as Absolute Software's CompuTrace LoJack for Laptops, contact that company.
A police report is needed to activate the tracking service.
Many computers registered for access to the Yale network have a unique Ethernet address number that is recorded by ITS when your computer is registered. It is possible that the computer might be found if it is re-connected to the campus network, using the Ethernet Hardware Address (also known as a "MAC address") of the device. Find your computer's Ethernet Hardware address.
If this is a Yale-owned device, please complete a Property Claim form to report the loss. All forms must be submitted within 24 hours of the incident.
Register the information you have about the machine with the National Stolen Computer Registry. You'll need to provide your computer's serial number. Your computer vendor may also have a registry that allows you to report the computer as stolen.
It also may be the case that if the computer or device is configured to automatically login to a service (such as email) at Yale (no matter where it is physically located), that we may be able to establish a location for the stolen device. If you have any questions or concerns, please feel free to contact us at firstname.lastname@example.org.