Healthcare data breaches have occurred more frequently over the past few years.¹ With the cyberattacks over the last year on Premera Blue Cross, Community Health Systems, Anthem Inc., and CareFirst, millions of Americans have had their information potentially exposed to hackers.² Not only have the cyberattacks occurred more frequently, but the number of patients exposed has also grown exponentially.³ In January 2015 alone, two different healthcare cyber security breaches were discovered, affecting more than 90 million Americans, compared to only two million affected individuals in the entirety of 2012.⁴ Even more troubling, the number of criminally motivated breaches, in contrast to employee negligence breaches, has risen to its highest level yet, and now accounts for 45% of all healthcare data breaches.⁵ These criminal attacks are most commonly committed by nation-state actors, malicious insiders, and thieves who physically steal information.⁶ In a 2015 study conducted by the security firm Ponemon Institute, 90% of the nearly 200 business associates and healthcare organizations surveyed experienced at least one data breach, and 40% of those surveyed experienced more than five breaches in the past two years.⁷

Healthcare data breaches have increased exponentially over the past few years, likely due to the extremely valuable information that healthcare entities possess, including names, social security numbers, credit card information, birthdays, addresses, and various medical data points.⁸ This information can be used to steal an individual’s identity to commit fraud or any number of other malicious acts.  Many attacks have not resulted in the collection of social security numbers or credit card information, but have resulted in the collection of other personal information.⁹ However, in the largest healthcare cyber security breach to date, which affected approximately 80 million Anthem, Inc. customers, hackers accessed the customers’ personal information, including social security numbers and employment information.¹⁰ Fortunately for Anthem customers, to date, no identity theft has been discovered from the breach, so there has not yet been a violation of the Health Insurance Portability and Accountability Act (HIPAA).¹¹

In August 2013, the U.S. Department of Health and Human Services (HHS) Office of Civil Rights Director Leon Rodriguez reported that the majority of data breaches occur because companies have failed to perform an adequate risk assessment and apply the findings to their current practices in order to strengthen those practices.¹² However, likely due in part to the increasing number of data breaches, healthcare entities have begun improving their security systems and developing stronger monitoring programs to check for weaknesses in their systems and respond to breaches more quickly.¹³ In 2013, 69% of healthcare organizations reported that they had some kind of security plan for data breaches, which was 7% higher than in 2012, and 27% of organizations reported that they were developing a plan.¹⁴ But indications suggest that these improvements may not be occurring fast enough or functioning effectively enough. The 2015 Ponemon Institute’s study found that approximately 58% of healthcare organizations believed their policies and procedures were effective at preventing data theft, but only 49% have the technology to effectively prevent the breaches, and 33% believe they have enough resources to prevent and detect breaches.¹⁵ Without adequate resources and functioning technology, the personal information of patients may still be at risk
of cyberattack.

In 2013, HHS implemented its HIPAA Final Omnibus Rule, which clarifies the conditions under which entities must report patient data breaches, and fines the companies up to $1.5 million per violation, depending on their level of negligence.¹⁶ According to Director Rodriguez, this rule is expected to increase the number of HIPAA breach cases that result in fines.¹⁷ However, by introducing stronger penalties for failure to safeguard patient information, the Omnibus rule may positively affect patients by encouraging healthcare organizations to better protect patient information from cyberattack.

The upward trend in healthcare data breaches is not likely to slow down going forward, considering the technology and information available to hackers. Consequently, healthcare organizations may have an even stronger motivation than before to develop effective security policies and procedures to protect patient information. The significant breach of Anthem’s database, which affected 80 million individuals, caused a “wake up call” for consumers who are beginning to show a greater concern for the safekeeping of their personal information.¹⁸ This heightened public awareness of the data breaches, coupled with the HIPAA Omnibus rule, may fuel the efforts of companies to protect the personal information of their consumers and monitor their privacy systems for problems.¹⁹