Most healthcare breaches still come from hacking

In 2017 the number of individuals affected by breaches within the healthcare sector reached a four-year low. However, 71 percentof breaches in 2017 were due to hacking and IT incidents, and a growing proportion growth trend that has continued since 2014, according to the Bitglass 2018 Healthcare Breach Report.

The fourth annual Healthcare Breach Report aggregates data from the U.S. Department of Health and Human Services’ Wall of Shame – a database of breach disclosures required as part of the Health Insurance Portability and Accountability Act (HIPAA) – to identify the most common causes of data leakage.

Bitglass explored the changes in breach frequency as well as the preventative steps organizations have taken to limit the impact of each breach from 2014 to 2017.

Key report findings

• The number of hacking and IT incidents have increased, but organizations have done a better job mitigating damage, with 16,060 records compromised on average in 2017.
• The number of breached healthcare records decreased in 2017 by 72 percent since 2015 and 95 percent since 2016 (excluding mega-breaches at Anthem and Premera).
• The number of 2017 data breaches dropped slightly to 294, down slightly from 2016 (328), indicated healthcare remains a target for hackers though many are shifting focus to other high-value targets like political campaigns.
• Over the past four years, healthcare organizations have consistently reduced the number of incidents attributed to lost and stolen devices; 63 percent reduction from 2014 to 2017.

“Mega-breaches like Anthem and Premera Blue Cross, along with device loss and theft caused healthcare breaches to spike in 2015 and 2016,” said Mike Schuricht, VP Product Management, Bitglass. “Since then, organizations in the health sector have made great strides in mitigating threats to protected health information (PHI) and in 2017, greatly reduced the total number of individuals affected by healthcare data breaches.”

Breach costs hit yet another record high

According to data from the Ponemon Institute, the cost per leaked record in the healthcare sector has once again risen, from $369 in 2016 to $380 in 2017.

For an organization subject to a large-scale IT incident, that can represent hundreds of millions in cost for identity theft protection, IT forensics, and government fines. Given the significant value of healthcare data – Social Security numbers, treatment records, credit information and more sensitive personal information – the cost of a breach to a hospital or health system can be destructive.

Find details on how CASBs can help you achieve compliance and protect against cloud data breaches in the full 2018 Healthcare Breach report.