7/28/2019 Breaches Cost Health Care Industry 6

1/2

Angela Moscaritolo

November 09, 2010

Breaches cost health care industry $6 billionannuallyDespite facing stricter privacy and security regulations, hospitals still are struggling to protect patient information,

and breaches cost the health care industry $6 billion annually, according to a new study.

In the survey of 65 health care organizations, conducted by the Ponemon Institute and sponsored by data breachsolutions provider ID Experts, 60 percent of respondents said they have suffered more than two breaches in the pasttwo years.

The top three causes of breaches were unintentional employee action, lost or stolen computing devices and third-

party accidents. The average number of lost or stolen records per breach was 1,769.

The survey found that breaches have cost the U.S. health care system $12 billion over the past two years. Theeconomic impact of a data breach was approximately $2 million per organization over a two-year period.

Moreover, federal regulations have not improved the safety of patient records, the survey found.

TheHealth Information Technology for Economic and Clinical Health Act, orHITECHAct, passed as part of the2009 economic stimulus bill, is intended to strengthen the protection of identifiable health information by expandingthe scope of theHealth Insurance Portability and Accountability Act (HIPAA)regulations.

But the majority of survey respondents said they do not believe the new regulation has significantly changed the

management practices of patient records.

The legislation, said to give "teeth" to the olderHIPAA, allows state attorneys general to obtain statutory damagesagainst noncompliant health care providers on behalf of state residents.

Doug Pollack, director of privacy and security at ID Experts, told SCMagazineUS.com on Tuesday that enforcementactions taken under the law thus far have been slow and mostly have affected health insurance companies, not healthcare organizations.

Consequently, protecting patient data is still not a priority for a majority of health care organizations, he said.

Revenue trumps privacy that's the way it is, Pollack said. There needs to be a handful of high-profile lawsuits

or penalties that are assessed against health care providers for not being in compliance. One or two of these willcause executives at health care systems to relook at their priorities.

In the survey, 67 percent of respondents said they have fewer than two staff members dedicated to data protectionmanagement.

Due to a lack of preparation and staffing, most health care organizations experience undetected breaches of patientdata, the survey found.

Page 1 of 2Breaches cost health care industry $6 billion annually - Print Article - SC Magazine

20/03/13http://www.scmagazine.com/breaches-cost-health-care-industry-6-billion-annually/printartic...

7/28/2019 Breaches Cost Health Care Industry 6

2/2

While we are seeing a lot of breaches being reported, there remain a lot that aren't reported because they goundetected, Pollack said. We are at a tip-of-the-iceberg situation where we aren't seeing the whole scope of the

problem.

Moreover, 58 percent of respondents said they have "little or no confidence" in their ability to appropriately securepatient records.

However, respondents are hopeful that the state of health care data security could improve with the adoption ofelectronic health records (EHR), the survey found. Fifty-six percent of respondents have either fully implemented orare in the process of implementing an EHR system.

Encouragingly, a majority of those who already have an EHR system say they believe it has made patient data moresecure.

Organizations are optimistic that modern security architectures will be implemented as part of the adoption of EHRsystems, Pollack said. But even so, he added, the move to digitized records creates new security concerns since itmakes data more available to employees and more susceptible to cybercrime.

This material may not be published, broadcast, rewritten or redistributed in any form without prior authorization.Your use of this website constitutes acceptance of Haymarket Media's Privacy Policy and Terms & Conditions

Page 2 of 2Breaches cost health care industry $6 billion annually - Print Article - SC Magazine

20/03/13http://www.scmagazine.com/breaches-cost-health-care-industry-6-billion-annually/printartic...