TRAVERSE CITY — The Traverse City security consultants Ponemon Institute released its Sixth Annual Benchmark Study on the Privacy & Security of Healthcare Data, showing that once again criminal attacks are the leading causes of data breach in healthcare.
The study, sponosred by Portland, Ore.-based ID Experts, also showed that mistakes — unintentional employee actions, third-party snafus, and stolen computer devices — are cited as the cause of other data breaches.
The findings indicate that many healthcare organizations and their third parties (business associates or BAs) are negligent in the handling of sensitive patient information. They also lack the budget, people resources, and expertise to manage data breaches caused by employee negligence and evolving cyber threats, including the newest threat cited for 2016: ransomware.
To learn more about the study, visit http://www2.idexpertscorp.com/ponemon2016 for a free copy.
Six Years Later: Data Breaches in Healthcare Are Not Declining
Data breaches in healthcare are costing the industry $6.2 billion, and remain consistently high in terms of volume, frequency, impact, and cost — and have yet to decline since 2010 — despite a slight increase in awareness and spending on security technology. While recent large healthcare data breaches have heightened the industry’s awareness of the growing threats to patient data and have led to an improvement in security practices and policy implementation, respondents say that not enough is being done to curtail or minimize the risks. Nearly half of healthcare organizations, and more than half of BAs, have little or no confidence that they can detect all patient data loss or theft.
“In the last six years of conducting this study, it’s clear that efforts to safeguard patient data are not improving. More healthcare organizations are experiencing data breaches now than six years ago,” said Larry Ponemon, chairman and founder of the Ponemon Institute. “Negligence — sloppy employee mistakes and unsecured devices — was a noted problem in the first years of this research and it continues. New cyber threats, such as ransomware, are exacerbating the problem.”
The Healthcare Industry: Vulnerable, Little Accountability
“This is about real people and the exposure of their sensitive information,” said Rick Kam, US president and co-founder of ID Experts. “The lack of accountability is a big issue in the healthcare industry, with a lot of finger pointing going on. To get a better handle on internal data threats, healthcare organizations can start by getting back to basics with employee training, mobile device policies, regular data risk assessments, and enforceable internal procedures.”
Key Findings of the Research
* Data breaches in healthcare remain consistently high in terms of volume, frequency, impact, and cost. Healthcare organizations are experiencing a greater volume and frequency of data breaches, suffering multiple data breaches each.
* Eighty-nine percent of healthcare organizations and 60 percent of BAs experienced data breaches over the past two years. Seventy-nine percent of healthcare organizations experienced multiple data breaches (two or more) in the past two years — up 20 percent since 2010. More than one-third, or 34 percent, of healthcare organizations experienced two to five breaches. Nearly half of healthcare organizations, or 45 percent, had more than five breaches.
* Medical records are the most commonly exposed data, followed by billing and insurance records, and payment details.
* While the majority of breaches are small (under 500 records) and are not reported to the U.S. Department of Health and Human Services and the media, the financial impact is significant. The total economic impact of data breaches is $6.2 billion to the healthcare industry.
* The newest cyber threat for 2016: ransomware. Criminal attacks are up in 2016 and are, once again, the leading cause of data breach among healthcare organizations, causing half of all data breaches and causing 41 percent of data breaches among BAs. Mistakes cause the other half of data breaches in healthcare. Based on the research, mistakes are classified as third-party snafus, stolen computing devices, and unintentional employee actions. The most concerning cyber threats among the healthcare industry are ransomware, malware, and DoS attacks. DoS attacks have been around a long time but continue to be prevalent. Ransomware is the newest cyber threat and concern for 2016. The study found that other top concerns to patient data are employee negligence, mobile device insecurity, use of cloud services, malicious insiders, and a growing concern about mobile apps (eHealth) — up from six percent in 2015 to 19 percent this year.
* Healthcare organizations believe they are more vulnerable to data breaches than other industries. Healthcare organizations have massive amounts of valuable data and often lack a strong security infrastructure and sense of accountability. Additionally, there are lots of “data touch” points, including multiple employees and third parties.
* The findings indicate that employees at healthcare organizations and their BAs are negligent in the handling of patient information and are not vigilant in protecting that information. Six years after the initial study, healthcare organizations are still stymied by the lack of resources and are not investing in technologies to mitigate a data breach. In fact, 59 percent of healthcare organizations and 60 percent of BAs don’t think their organization’s security budget is sufficient to curtail or minimize data breaches.
* The findings also reveal that BAs and healthcare organizations point their fingers at each other. Healthcare organizations say that third parties and partners are not doing enough, and BAs say that healthcare organizations are not investing in technology and employees are negligent.
* The research indicates that more healthcare organizations and BAs are aware of medical identity theft cases that have occurred internally since last year’s study. Thirty-eight percent of healthcare organizations and 26 percent of BAs are aware of medical identity theft cases affecting their own patients and customers. Healthcare organizations and BAs both agree that patients suffer an increased risk of medical identity theft and financial identity theft if their records are exposed. Despite the known risks, 64 percent of healthcare organizations and 67 percent of BAs don’t offer any protection services for victims whose information has been breached.
* Fifty-eight percent of healthcare organizations and 67 percent of BAs do not have a process in place to correct errors in victims’ medical records. Errors in medical records can be detrimental to a patient, putting the patient at risk. Such errors can leave a patient vulnerable to receiving the wrong medical treatment or obtaining the wrong medications. If an identity thief uses a patient’s name or health insurance number in order to receive medical care, the patient’s health history and record will get mixed with the thief’s, potentially causing harm to the patient.
The study used in-depth, field-based research involving interviews with senior-level personnel at healthcare providers and business associates to collect information on the actual data loss and data theft experiences at their organizations. This benchmark research, in contrast to a traditional survey-based approach, enables researchers to collect both the qualitative and quantitative data necessary to understand the current status of the privacy and security of the healthcare data of those who participated in the study.
More about ID Experts at www2.idexpertscorp.com.