HITRUST: Little improvement in data breach prevention since 2009

The healthcare industry has made little progress in controlling data breaches, according to the Health Information Trust Alliance's (HITRUST) analysis of U.S. healthcare data breaches since 2009.

A retrospective analysis of breaches affecting 500 or more individuals indicates a slight decline in the total number of breaches during the past three years, but overall the healthcare community's susceptibility to certain types of breaches has been largely unchanged since breach data became available from the Department of Health and Human Services (HHS) and the HIPAA and HITECH Act regulations went into effect.

Since 2009, the industry has experienced 495 breaches involving 21 million records at an estimated cost of $4 billion. With the annual number of total breaches remaining fairly consistent, hospitals and health systems is one of the few groups that can claim some improvements in protecting health information with the largest decline in reported breaches. This group experienced a decline of 71 percent from 2010 to 2011 in the number of breaches, and for the first two quarters of 2012 only experienced 14 breaches (compared with a total of 48 for 2011). Health plans also have seen a steady decline in breaches since 2009 and have not had to post since the first quarter of 2012.

Meaningful Use Stage 1 may have incentivized and raised awareness for the need for security, particularly with laptops, desktops and mobile media. However, the data indicate that physician practices, which should be similarly motivated by meaningful use incentives, have continued to demonstrate a lack of progress. Smaller physician practices—those with 100 or fewer employees—account for more than 60 percent of the breaches reported in the segment. The analysis indicates that organizations such as these likely lack the awareness and resources to adequately recognize the issues and take actions to preempt future breaches.

Meanwhile, reported hacking and malware infections remain low, accounting for just 8 percent of the breaches.

HITRUST recently launched the Cyber Threat Analysis Service (CTAS) in partnership with iSIGHT Partners to identify and analyze cyber threats to the U.S. healthcare industry. The CTAS has published more than a half-dozen reports of healthcare data being exploited in underground message boards by cybercriminals from the U.S., Russia and China that cannot be linked back to the reported breaches from HHS. In addition, the service has found that malware is present on approximately 30 percent of endpoint devices in smaller healthcare organizations.

A November 2012 report from the CTAS highlights this new dynamic in the cause for breaches with the observation that a database containing personally identifiable information and protected health information was advertised for purchase on a prominent cybercrime forum.

HITRUST's assessment data suggests many breaches may go unreported or undiscovered. “Because of the gap between the breach data and other sources,” says HITRUST CEO Daniel Nutkis, “we believe the breaches being reported are not all inclusive. While we do not have a sense of the exact magnitude, given the cyber threats that healthcare and other industries face, we believe it must continue to be taken seriously.”

The HITRUST analysis identified other areas of concern for the industry:

• Breaches of paper records remain significant among the leading segments (providers, payers, government) with errors in mailing and disposal of records playing a substantial role in some of the highest profile paper-based breaches. Since 2009, paper records comprise 24 percent of healthcare breaches, second only to laptops.
• Business associates continue to account for a significant number of breaches (21 percent) and are implicated in a majority of the records breached to-date (58 percent). This continues to be a problem across all organization types, with physician practices struggling the most.
• The average time to notify individuals and HHS following a breach is 68 days, with over 50 percent of organizations failing to notify within the 60 day deadline set by HITECH.

The complete HITRUST report is available for download.