We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Medical data breaches soar, according to study

Security breaches among healthcare organizations are soaring. That's the conclusion of the Second Annual Benchmark Study on Patient Privacy and Data Security conducted by the Ponemon Institute and sponsored by ID Experts.

A total of 72 healthcare organizations where surveyed, and, on average, the cost of data breaches to these organizations rose $183,526 to $2,243,700 from 2010. The absolute number of breaches are also increasing: up 32 percent year over year, with 96 percent of those providers surveyed reporting at least one data breach in the past 24 months.

Also see: Why healthcare IT security is harder than the rest

Extrapolating the study to the entire healthcare industry, Ponomon estimates that data breaches could be costing the U.S. healthcare industry between $4.2 billion and $8.1 billion a year, or an average of $6.5 billion.

The majority of these breaches weren't caused by sophisticated hacks or so-called advanced persistent threats. No. Most of the breaches, the survey found, were the result of employees losing or having their IT devices stolen or other unintentional, but ill-advised, employee action according to 49 and 41 percent of respondents. Shoddy security from partners and providers, including business associates, according to 46 percent of participants, was another significant reason.

There was some good news from the study: the percentage of respondents who had breaches discovered by their patients dropped from 41 percent to 35 percent.

The reason for the increase in breaches overall? There could be a number of factors, says Larry Ponemon of the Ponemon Institute, such as an increase in the use of IT in the health care industry and more attacks targeting that electronic medical information. Perhaps an increase in regulatory demands is causing healthcare organizations to look more closely for breaches, and so they're finding more. Or, perhaps, the reason for the increase is a mix of each of those trends, Ponemon said.

Once a breach is discovered, 83 percent of hospitals reported it taking one to two months to notify affected patients. Nearly a third, or 29 percent, admitted that breaches lead to cases of identity theft, a figure that rose 26 percent from the previous year.

"It's easy to lose sight on what big numbers like $6.5 billion annually mean," says Rick Kam, president and co-founder of ID Experts. "But that's enough money to pay the salaries of an additional 81,000 registered nurses a year."

A copy of the survey is available. Registration is required.

George V. Hulme writes about security and technology from his home in Minneapolis. You can also find him tweeting about those topics on Twitter at @georgevhulme.

Read more about data privacy in CSOonline's Data Privacy section.


IDG UK Sites

Sony Xperia Z3 Compact review: A better deal than the Z3 and most smartphones

IDG UK Sites

Why people aren't upgrading to iOS 8: new features are for power users, not the average Joe

IDG UK Sites

Framestore recreates ancient China for Mr Bean's martial arts misadventure

IDG UK Sites

iPad Air 2 review: Insanely fast and alarmingly thin. Speed tests, camera tests and more