We highly discourage travelling with PHI data if possible. However, we understand that sometimes the need to travel with sensitive data (including PHI data) is necessary. Please see the FAQ below for some guidance on travelling with PHI data.
What should I do if asked to provide my password to my laptop or other device and I have patient data or PHI on it?
- We suggest that you not provide your password. Rather, unlock the machine for the Customs and Border Protection (CBP) agent if you are compelled to do so.
- Our understanding is that CBP cannot make you provide your password, but that they do have some rights to inspect your electronic devices.
- “Compelled” could be due to subpoena, a CBP agent showing you the section of the law that provide CBP a right to require you to unlock your device for inspection, or circumstances are such that you believe you have little other viable option.
How can I comply with Customs and Border Protection, but not release PHI?
If you unlock your device for inspection before turning over the device let the CBP agent know that you are affiliated with Appalachian State University (professor, researcher, student, etc.) and have HIPAA-protected health information on the machine. To that end you request that CBP limits their review to exclude the protected health information (PHI).
- Also, try your best to obtain the name and title of each CBP person reviewing your device.
- Tell CBP that federal law requires you have to keep a listing of all disclosures of patient information to third parties. This is why you are asking for their name/title.
- Try to inform the agent and obtain names/titles before you turn over the device.
- If you cannot get names/titles, then get the best information you can and submit that information to irb@appstate.edu as soon as you can.
Can I take my laptop in my carry-on if I travel internationally?
Yes, you can take your laptop with you in the cabin on international flights.
What should I do if my device is confiscated?
- Obtain the name and title of the individual confiscating your device.
- Obtain a “receipt” or comparable written documentation that describes the device confiscated, under what authority, for what purposes, by whom and whom to contact regarding return of the device.
- If your device contains PHI let the agent know that you are affiliated with Appalachian State University (professor, researcher, student, etc.) and have HIPAA-protected health information on the machine.