Hmmmm
I think that the responsibility in this case is two-fold...the responsibility of the individual to keep his laptop stored securely (i.e. not leaving it in his car) and the responsibility of the board to make sure that hospital data and machines are secure anywhere at any time...not having an encrypted storage device is criminal nowadays as the technology is not immature and not overly expensive or difficult to deploy...for the sake of all, give the man his job back with a reprimand and look at yourselves!