This week’s Rip is another episode of the “unencrypted external hard drive” show. Thanks to lyger over at DataLossDB for the heads up. The Fresno Bee reports that an external hard drive was stolen, containing names, medical record numbers, and for some patients, ages, dates of birth, gender, phone numbers and other information related to their care and treatment.

And, to the chagrin of at least 15,000 people, it was not encrypted. This also teaches us a familiar lesson about policies and procedures:

1. They are good. The employee knew what was expected of him or her, which was not to store information on the drive.
2. They are completely insufficient on their own. The employee violated, was fired (surely the stated policies and procedures made that tidy)…yet the 15,000 people are still breached.

It’s better to encrypt.