Lessons Learned From Major Healthcare Breaches
Huge amounts of personal health data being collected, shared & analyzed. There are more reasons to worry about patient privacy than ever.
Recent leaps in technology toward health care digitization have resulted in unprecedented amounts of personal health data being collected, shared, and analyzed on an everyday basis. Due to this proliferation in data, there are now more reasons to be concerned about patient privacy than ever.
Despite public concerns and government’s efforts, the frequency and magnitude of privacy breaches have been on an upward trend (see figure below) and data breaches are more likely to happen in the health care industry than any other sector. In this new report, Niam Yaraghi examines the recent privacy breaches in the health care system. He uncovers underlying factors leading to these incidents, documents lessons learned, and examines how to prevent similar breaches in the future.
Yaraghi and a team of researchers conducted a series of 22 in-depth interviews with key personnel at a wide variety of health care providers, health insurance companies, and industry business associates. These interviews revealed important lessons that are generalizable across the health care industry. Yaraghi identifies and explains several reasons that the health care sector is particularly vulnerable to privacy breaches:
- Health care data are richer and more valuable for hackers.
- Too many people have access to medical data;
- Medical data are stored in large volumes and for a long time;
- The health care industry embraced information technology too late and too fast;
The health care industry did not have strong economic incentives to prevent privacy breaches; and
As Yaraghi illustrates, medical data breaches can be especially catastrophic because they contain information that cannot be changed. If credit card information gets breached resulting in an unauthorized charge, the card issuer will instantly reverse the charge, freeze the old card, and send a new one. On the other hand, most medical data includes identifiers such as social security numbers, dates of birth, and home addresses which are nearly impossible to change or reset upon a breach. Precisely because of their constant and unchangeable nature, medical data are worth more than financial data on the black market. In hopes of lessening the catastrophic nature of such attacks, Yaraghi makes the following policy recommendations to better protect patient privacy and prevent breaches:
Health care organizations should prioritize patient privacy and use the available resources to protect it
The Office of Civil Rights (OCR) should better communicate the details of its audits
Health care organizations should better communicate with each other
OCR should establish a universal HIPAA certification system
The health care sector should embrace cyber insurance
