If there was a data breach in the healthcare industry in 2016, it was likely due to cyber thieves gaining access to it via network intrusion, by placing malware on a system, gaining access to someone’s credentials, or some other type of “hack.” Unfortunately, it’s not likely going to slow down in 2017. That is because the information that can be gained is very valuable. It sells for up to $50 per record on the Dark Web.
As of early January 2017, the U.S. Department of Health and Human Services (HHS) reported that 16.1 million individuals were affected by breaches. These impacted 500 or more people per incident. The total number of those incidents was 310. However, as more details of others filter into HHS, that number is expected to grow.
While the Anthem breach of 2015 remains the largest in the healthcare industry, affecting nearly 79 million individuals, there were other significant breaches in 2016.
Here are the incidents that affected the largest number of people and involved a cyber thief hacking into a network and stealing information:
- Central Ohio Urology Group - 300,000
- Peachtree Orthopedic Clinc - 531,000
- County of Los Angeles Departments of Health and Mental Health - 750,000
- Valley Anesthesiology Consultants - 883,000
- 21st Century Oncology - 2.2 million
- Newkirk Products - 3.5 million
- Banner Health - 3.6 million
In just the five largest listed, nearly 11 million people were impacted.
The following were large breaches that involved an incident other than someone entering a network. These include information that involved a loss such as an employee losing hard drives, or unauthorized access when someone reportedly used third party login credentials to access the information.
- California Correctional Health Care Services - 400,000 - Theft
- Radiology Regional Center - 483,000 - Loss
- Bon Secours Health System - 652,000 - Unauthorized access/disclosure
Including the above Bon Secours Health Systems, 126 (nearly one-third) instances are listed as “unauthorized access/disclosure.”
Federal regulators have been tracking major healthcare breaches since 2009. Since then, they have listed 1,785 of them affecting nearly 171 million people. Surprisingly, only 258 of those are considered hacking incidents. More shocking is that those 258 affected 129 million people.
Why is the data from healthcare so valuable? It’s because of the type of information that is stored in these. It includes names, birth dates, social security numbers, vital statistics, healthcare providers, medical conditions and diagnoses, to name a few. This is more than enough information for identity theft, but with rising healthcare costs and now the insecurity of what will happen with the Affordable Care Act and peoples’ access to health insurance, healthcare fraud is made much more desirable to fraudsters.
What isn’t included in the list by HHS are ransomware attacks. These, like the one that hit Hollywood Presbyterian Medical Center are likely to increase in the coming years. All organizations and individuals need to make sure they are doing regular backups so they can be ready for it, just in case. Although some organizations such as Hollywood Presbyterian Medical Center and even some law enforcement organizations had to pay to get their information back, it is not recommended. The one thing that encourages more ransomware attacks is paying the criminals for bad behavior.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
