After Change Healthcare, ePHI Still Sits on Staff Devices
The clearinghouse number is settled enough to brief. The laptop in the on-call bag is not settled until you can wipe it.
By July 31, 2025, Change Healthcare's estimate stood at about 192.7 million people potentially impacted. HHS recorded the updates in public. A clinic that has filed that number and stopped is only half done. Electronic protected health information also lives on the devices staff use to do the work the clearinghouse interrupted: laptops, tablets, phones, shared PCs in a nursing station.
HIPAA's security rule still expects you to know where ePHI is and what you do when a device is lost. A vendor notice does not answer the lost-device question. Remote wipe does, if the device was enrolled and encrypted, and if someone is allowed to send the command.
A short clinical test
- Pick five roles that routinely open patient information. Trace each to a specific device.
- Confirm encryption and a last check-in. A device that has not checked in for months is not a managed device.
- Run a wipe test on a spare, then put the same admin path on the on-call list.
The paper trail is in the August 2025 count. The product path is DriveStrike: wipe enrolled drives, lock, locate. Spearstone will not tell you DriveStrike replaces a business-associate agreement. It will tell you a BAA does not wipe a laptop. Read how Spearstone approaches data security, then trial the endpoint control or contact the team.
Keep reading
- When the Employee Leaves and the Laptop Does Not Come Back
- The Unmanaged Phone Is Where Corporate Passwords Keep Showing Up
Questions worth answering directly
Does the Change Healthcare incident mean a clinic was breached through its laptops?
Not by itself. The incident was at the clearinghouse. Clinics can still have a separate loss if their own devices holding ePHI are stolen or not returned.
What Change Healthcare figure is current as of this article?
Approximately 192.7 million individuals potentially impacted, as Change Healthcare reported on July 31, 2025, with the caveat that complete deduplication was not feasible.