A Q3 2018 healthcare data breach report from Protenus demonstrates there has been a substantial decrease in healthcare data breaches compared to the preceding quarter. In Q2, 142 healthcare companies reported data breaches compared to 117 in Q3.
However, because of some big breaches in Q3, the total number of disclosed records was considerably higher. Between July and September, the health records of 4,390,512 patients were disclosed, impermissibly disclosed, or thieved compared to 3,143,642 healthcare records in Q2. Each quarter in 2018, the number of disclosed records has increased considerably.
The large increase in disclosed records in Q3 is partly because of a huge data breach at UnityPoint Health that was disclosed in July. In that single breach, more records were disclosed than in the 110 healthcare data breaches in Q1, 2018. The breach was a phishing attack that saw a number of UnityPoint Health electronic mail accounts undermined. Those accounts had the PHI of 1.4 million patients. The biggest healthcare data breach in August was a hacking occurrence at a healthcare supplier that led to the disclosure of 502,416 records. The biggest breach in September was reported by a health plan and affected 26,942 plan members.
Hacking and other IT occurrences comprised of 51.28% of all data breaches in Q3. The second largest cause of breaches was insider occurrences (23.08%), after that loss/theft occurrences (10.26%). The reason of 15.38% of breaches in Q3 is not clear.
Hacks and IT occurrences also led to the maximum number of exposed/stolen healthcare records – 86% of all breached records in Q3. 3,649,149 records were undermined in the 60 occurrences pertained to hacks and IT occurrences. There were 8 reported ransomware/malware attacks and 10 occurrences involving phishing. It was not possible to decide the precise reason
Q3 saw a surge in insider breaches. Insider breaches were divided into two types: insider flaws and insider crime. Insider crime contains impermissible disclosures of PHI, workers spying on medical records, and theft of healthcare records by workers. Insider breaches led to the thievery, exposure, or impermissible revelation of 680,117 patient records.
19 occurrences were categorized as insider flaws and affected 389,428 patients. There were 8 verified cases of insider crime that affected 290,689 patients – which is a major surge from the 70,562 patients affected by insider wrongdoing occurrences in Q2, and the 4,597 patients affected by similar occurrences in Q1.
In Q3, 19% of breaches involved paper records and 81% involved electronic medical records.
Healthcare suppliers suffered the most breaches in Q3 (74% of breaches), followed by health plans (11%) and business allies (11%). 23% of the quarter’s breaches had some business associate participation.
The report discloses that healthcare companies and their suppliers are sluggish to identify breaches. In one instance, it took a healthcare supplier 15 years to find out that a worker had been spying on healthcare records. In those 15 years, the worker illegally accessed the records of thousands of patients.
The average time to identify a breach was 402 days and the median time was 51 days. The average time to inform breaches was 71 days and the median time was 57.5 days.
Florida was the state worst affected by healthcare data breaches in Q3 with 11 incidents, followed by California on 10 and Texas on 9.