Q: One of our employees went home sick and never returned. After must back-and-forth, we fired him. However, he still has a company-issued laptop, with confidential patient information on it (we’re a medical practice). What do we do to get the laptop back, and secure the confidential information on the computer from his further access or use?
A: Initially, employers probably cannot recoup the cost of the laptop by deducting earned wages from the employee’s last paycheck. Many states prohibit such self-help measures. And, the paycheck may not be sufficient to cover the cost of the laptop. In addition, the potential HIPAA considerations in this case require that the employer secure the device itself or terminate the employee’s access. Thus, here are the suggested steps when an employee who has a company-issued laptop departs or losses employment:
- Remind the employee of any confidentiality and equipment-loaner agreements that they have signed during their employment. This notice can be done in writing or over the phone.
- Notify the employee that any possession of confidential information and company equipment after the employment relationship has ended is unlawful and in violation of the agreement that the employee signed. For HIPAA covered entities, the employee should also be reminded that they cannot view, print, copy or in any other way access PHI that might be stored on the company’s device.
- Make arrangements for the employee to return the equipment. Employers can even send messengers to their employee’s home to pick up the device.
- If contents from the laptop are really in a cloud, the employer should shut the employee’s access to the cloud immediately and demand a certification from the employee that they have not made any copies of any confidential information on the laptop, printed any documents from computer, emailed to themselves protected documents, or somehow extrapolated PHI or other confidential information.
- When the computer is returned to the employer, review the usage history on the laptop to determine if/what the employee did with any confidential information in the days leading up to the termination and up until the device was returned.
- If the employee fails to respond to the employer’s requests to return the property, the employer should consider criminal and civil avenues to enforce its rights.