2013 Healthcare Breach Report

If you have followed my blog, you know that I annually review the US HHS breach report, just to see what kind of year we had in healthcare security.  Well, enough time has gone by since the end of year reporting to make sure we have captured the stragglers.  Prior years observations are here for 2010,  here for 2011, and here for 2012.

This year I firmed up our counting rules.  For example, I count all the multi-year breach counts in the year that the last breach report ended.  So there are some slight variations from prior years reporting.

A couple of observations:

• 2012 now seems to have been an anomaly around breach reporting, we got back on a growth track in 2013 for breaches.  Something to look forward to (uggh).
• We are at 30 Million individually identifiable healthcare records that were breached to date.  In four years we have exposed protected health information for 10% of the population.  I don’t think this cadence of breaches will change – in fact it may very well accelerate.  Get ready for a world where your health info is readily available – legitimately or not.
• There is a whole lot of press on the 40 Million credit card numbers that were hacked at Target.  That’s an estimate, probably at the high end, and we don’t know how many of those were (or are) still valid numbers.  Not a word in the media about the 30 Million healthcare records out in the wild.  Healthcare is more than just about “What’s in your wallet” (apologies to Capital One).  That said, stolen credit card numbers are easily monetized, while stolen (or lost) healthcare records are a whole different story (note that some of these breaches included card numbers).  Which one is the more serious breach type, I’ll leave to a discussion for another day.
• In 2013 Advocate Health in Illinois  joined a very exclusive club –  “The Over 4 Million Records Breached” club.  There is only one other member – TRICARE in Virginia.  The next largest breach of all time is almost 2M Million records – ostensibly by IBM working for Health Net in California.

Here’s what the number of breaches over the past four years, based on government data , looks like:

Then there is the hall of shame.  Let’s recap the top 3 largest breaches by year:

And from the “will they ever learn?” department, these cases jump out:

Can’t wait to see what happens in 2014….