89% of Organizations Experienced Data Breaches, According to New Ponemon Report

Criminal Attacks Cause 50 Percent of Breaches, Exposing Patient Data; Ransomware Is Newest Cyber Threat for 2016

TRAVERSE CITY, Mich. and PORTLAND, Ore. — May 12, 2016 — It’s a turbulent time for the healthcare industry: patient data is under siege and hospitals are big targets for cyber attacks—according to the Sixth Annual Benchmark Study on Privacy & Security of Healthcare Data, conducted by Ponemon Institute and sponsored by ID Experts^®. For the second year in a row, the study reveals that criminal attacks are the leading cause of data breaches in healthcare—up five percent to 50 percent this year. Mistakes—unintentional employee actions, third-party snafus, and stolen computer devices—are cited as the root cause of the other half of data breaches. The findings indicate that many healthcare organizations and their third parties (business associates or BAs) are negligent in the handling of sensitive patient information. They also lack the budget, people resources, and expertise to manage data breaches caused by employee negligence and evolving cyber threats, including the newest threat cited for 2016: ransomware. To learn more about the Sixth Annual Study on Privacy & Security of Healthcare Data, visit http://www.idexpertscorp.com/ponemon2016 for a free copy.

Six Years Later: Data Breaches in Healthcare Are Not Declining

Data breaches in healthcare are costing the industry $6.2 billion, and remain consistently high in terms of volume, frequency, impact, and cost—and have yet to decline since 2010—despite a slight increase in awareness and spending on security technology. While recent large healthcare data breaches have heightened the industry’s awareness of the growing threats to patient data and have led to an improvement in security practices and policy implementation, respondents say that not enough is being done to curtail or minimize the risks. Nearly half of healthcare organizations, and more than half of BAs, have little or no confidence that they can detect all patient data loss or theft.

“In the last six years of conducting this study, it’s clear that efforts to safeguard patient data are not improving. More healthcare organizations are experiencing data breaches now than six years ago,” said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. “Negligence—sloppy employee mistakes and unsecured devices—was a noted problem in the first years of this research and it continues. New cyber threats, such as ransomware, are exacerbating the problem.”

The Healthcare Industry: Vulnerable, Little Accountability

“This is about real people and the exposure of their sensitive information,” said Rick Kam, CIPP/US president and co-founder of ID Experts. “The lack of accountability is a big issue in the healthcare industry, with a lot of finger pointing going on. To get a better handle on internal data threats, healthcare organizations can start by getting back to basics with employee training, mobile device policies, regular data risk assessments, and enforceable internal procedures.”

Key Findings of the Research

• Data breaches in healthcare remain consistently high in terms of volume, frequency, impact, and cost. Healthcare organizations are experiencing a greater volume and frequency of data breaches; suffering multiple data breaches each. Eighty-nine percent of healthcare organizations and 60 percent of BAs experienced data breaches over the past two years. Seventy-nine percent of healthcare organizations experienced multiple data breaches (two or more) in the past two years—up 20 percent since 2010. More than one-third, or 34 percent, of healthcare organizations experienced two to five breaches. Nearly half of healthcare organizations, or 45 percent, had more than five breaches. Medical records are the most commonly exposed data, followed by billing and insurance records, and payment details. While the majority of breaches are small (under 500 records) and are not reported to the U.S. Department of Health and Human Services (HHS) and the media, the financial impact is significant. The total economic impact of data breaches is $6.2 billion to the healthcare industry.

• Newest cyber threat for 2016: ransomware. Criminal attacks are up in 2016 and are, once again, the leading cause of data breach among healthcare organizations, causing half of all data breaches and causing 41 percent of data breaches among BAs. Mistakes cause the other half of data breaches in healthcare. Based on the research, mistakes are classified as third-party snafus, stolen computing devices, and unintentional employee actions. The most concerning cyber threats among the healthcare industry are ransomware, malware, and DoS attacks. DoS attacks have been around a long time but continue to be prevalent. Ransomware is the newest cyber threat and concern for 2016. The study found that other top concerns to patient data are employee negligence, mobile device insecurity, use of cloud services, malicious insiders, and a growing concern about mobile apps (eHealth)—up from six percent in 2015 to 19 percent this year.

• Healthcare industry is more vulnerable to data breach than other industries. Healthcare organizations believe they are more vulnerable to data breaches than other industries. Healthcare organizations have massive amounts of valuable data and often lack a strong security infrastructure and sense of accountability. Additionally, there are lots of “data touch” points, including multiple employees and third parties. The findings indicate that employees at healthcare organizations and their BAs are negligent in the handling of patient information and are not vigilant in protecting that information. Six years after the initial study, healthcare organizations are still stymied by the lack of resources and are not investing in technologies to mitigate a data breach. In fact, 59 percent of healthcare organizations and 60 percent of BAs don’t think their organization’s security budget is sufficient to curtail or minimize data breaches. The findings also reveal that BAs and healthcare organizations point their fingers at each other. Healthcare organizations say that third parties and partners are not doing enough, and BAs say that healthcare organizations are not investing in technology and employees are negligent.

• Patients are suffering the effects of data breaches; increased awareness of medical identity theft cases. The research indicates that more healthcare organizations and BAs are aware of medical identity theft cases that have occurred internally since last year’s study. Thirty-eight percent of healthcare organizations and 26 percent of BAs are aware of medical identity theft cases affecting their own patients and customers. Healthcare organizations and BAs both agree that patients suffer an increased risk of medical identity theft and financial identity theft if their records are exposed. Despite the known risks, 64 percent of healthcare organizations and 67 percent of BAs don’t offer any protection services for victims whose information has been breached. Fifty-eight percent of healthcare organizations and 67 percent of BAs do not have a process in place to correct errors in victims’ medical records. Errors in medical records can be detrimental to a patient, putting the patient at risk. Such errors can leave a patient vulnerable to receiving the wrong medical treatment or obtaining the wrong medications. If an identity thief uses a patient’s name or health insurance number in order to receive medical care, the patient’s health history and record will get mixed with the thief’s, potentially causing harm to the patient.

Research Findings Further Discussed in Webinar

Join Dr. Larry Ponemon and Rick Kam to hear highlights of the study via a complimentary webinar, Hackers are Coming After Your Healthcare Data, to be held on May 17, 2016, at 11:00 a.m. PT/2:00 p.m. ET. To register: https://www.idexpertscorp.com/webinars/hackers-are-coming-after-your-healthcare-data.

About the Study

The Sixth Annual Benchmark Study on Privacy & Security of Healthcare Data utilized in-depth, field-based research involving interviews with senior-level personnel at healthcare providers and business associates to collect information on the actual data loss and data theft experiences at their organizations. This benchmark research, in contrast to a traditional survey-based approach, enables researchers to collect both the qualitative and quantitative data necessary to understand the current status of the privacy and security of the healthcare data of those who participated in the study.

About Ponemon Institute

Ponemon Institute is dedicated to advancing responsible information and privacy management practices in business and government. To achieve this objective, the Institute conducts independent research, educates leaders from the private and public sectors and verifies the privacy and data protection practices of organizations in a variety of industries.

About ID Experts

At ID Experts, we protect millions of consumers with our identity protection software and services and have a 100 percent success record for identity recovery. We are trusted by thousands of organizations to manage cyber and other risks with our data breach response services. We are the largest provider of identity protection products to the federal government. We serve customers in healthcare, government, insurance, financial services, and higher education. ID Experts actively contributes to the cyber risk community through organizations including NHCAA, HCCA, MIFA, and IAPP. Visit www.idexpertscorp.com/