There have been a couple of instances where malware infected USB drives have been given away unknowingly as promotional items at conferences, e.g., [IBM in 2010](http://blogs.computerworld.com/16800/ironic_malware_infected_usb_security_blunders). 

Besides this, if a healthcare company were to give away "branded" USB drives, what other risks might be involved with such giveaways?

Further, if the recipient of the drive downloads their personal medical information to the drive, and it gets lost, can the healthcare provider be implicated?