An investigator obtains consent and HIPAA authorization from subjects to review their medical records and HIV status. He plans to go back to the medical record, so the HIV status information is stored along with subject identifiers in a database that he keeps on his laptop computer. His laptop is stolen. This incident constitutes:________