August 9, 2017
At Stanford, we take the safety and welfare of our community members very seriously. Recent travel restrictions, bans and limitations on certain devices on airplanes coming into the Unites States from specific countries have also created unique challenges with respect to data privacy and security. This document is intended to provide guidance to community members traveling internationally with High Risk, confidential Stanford data on laptops and other electronic devices. As this area continues to evolve, we will update this document. Additional resources are offered at the end of this document. If you have questions related to protecting confidential Stanford information, please contact the University Privacy Office at email@example.com.
What should I do if asked to provide my password to my laptop or other device and I have patient data or PHI on it?
- We suggest that you not provide your password. Rather, unlock the machine for the Customs and Border Protection (CBP) agent if you are compelled to do so.
- Our understanding is that CBP cannot make you provide your password, but that they do have some rights to inspect your electronic devices.
- “Compelled” could be due to subpoena, a CBP agent showing you the section of the law that provide CBP a right to require you to unlock your device for inspection, or circumstances are such that you believe you have little other viable option.
How can I comply with Customs and Border Protection, but not release PHI?
If you unlock your device for inspection before turning over the device let the CBP agent know that you are affiliated with Stanford (clinician, researcher, student, etc.) and have HIPAA-protected health information on the machine. To that end you request that CBP limits their review to exclude the protected health information (PHI).
- Also, try your best to obtain the name and title of each CBP person reviewing your device.
- Tell CBP that federal law requires you have to keep a listing of all disclosures of patient information to third parties. This is why you are asking for their name/title.
- Try to inform the agent and obtain names/titles before you turn over the device.
- If you cannot get names/titles, then get the best information you can and submit that information to firstname.lastname@example.org as soon as you can.
Can I take my laptop in my carry-on if I travel internationally?
Yes, you can take your laptop with you in the cabin on international flights. The March 21, 2017 US Department of Homeland Security (DHS) ban on electronic devices larger than a cell phone or a smart phone from cabins on airplanes entering the U.S. from certain airports has been lifted. DHS will require increased screening procedures for all flights entering into the US in the weeks and months to come.
What should I do if my device is confiscated?
- Obtain the name and title of the individual confiscating your device.
- Obtain a “receipt” or comparable written documentation that describes the device confiscated, under what authority, for what purposes, by whom and whom to contact regarding return of the device.
- If your device contains PHI let the agent know that you are affiliated with Stanford (clinician, researcher, student, etc.) and have HIPAA-protected health information on the machine.