The VA is liable for this. There is no reason or excuse for this to occur with today's technology. Even in the remote chance that there's a valid reason for having patient data on a laptop, the data should be encrypted. Laptop encryption software is automatic, widely available, and is transparent to the user, except that a special login screen needs to be entered before Windows starts. Pointsec is an example of such software. The trend in security policy is that all customer or employee data, and any other sensitive data where privacy is an issue, must be stored on a network. The potential for privacy lawsuits is tremendous now and no company wants the kind of liability that such suits entail.
