A recent settlement between the Office for Civil Rights and a university medical center involving the payment of $3 million and the establishment of a corrective action plan following the loss of an unencrypted flash drive and the theft of an unencrypted laptop used by a medical resident highlights a number of important lessons that all private healthcare practices should keep in mind to stay out of HIPAA trouble.