Storage of personal health data on such devices has proven a very costly risk for several high-profile institutions as well as individual medical practices when such devices were lost or stolen and a security breach needed reporting. The HIPAA imposes rather stiff penalties for even inadvertent release of patient medical information to unauthorized persons, a liability that is not covered by most general business insurance. Prevention in the form of good practices, solid policies, training, and awareness is critical to escaping the potentially large fines for release of protected health information (PHI) . A number of notable large institutions have received negative press and faced liability following the loss of electronic media such as hard drives, laptops, or other media containing even seemingly innocuous patient-identifiable data such as admission dates, accession numbers, zip codes, etc. Federal law requires practices to have HIPAA policies in place, as do quite a few states. Every practice should have an HIPAA privacy and security officer who is responsible for ensuring that appropriate practices and policies have been implemented, and who can assist in coordinating a response in the event of a possible privacy breach.