Profiles in patient privacy protection

Medical Data Breaches, By Year

Since 2010, 1,819 data breaches affecting 500 or more patients have occurred in the U.S. originating from both health-care providers and their third-party business associates. In 2013, new HIPAA regulations required business associates to put in place safeguards to protect patient information. The rules have prevented an estimated 165 breach incidents among business associates. OCR announced the HIPAA omnibus rules on January 25, 2013. These rules became effective March 26, 2013, with compliance required by September 23, 2013.

Individuals affected by medical data breaches

Implementation of the HIPAA omnibus rules coincided with a spike in the number of privacy breaches in the health care market. Based on this observation, one could argue that had the omnibus rules not been in place, we would have observed a similar spike in the number of privacy breaches among business associates. In other words, implementation of the rules has dampened the effects of an otherwise powerful driver of privacy breaches.

^*Through March 1, 2017

Total individuals affected by medical breach type between 2010–2016^*

More than 171 million Americans have had their privacy jeopardized by health care data breaches in the past seven years. The most common kind of data breach (13.8%) was the result of Theft, though more people were affected by Hacking/IT incidents, which can threaten the privacy of more individuals at one time.

1. Hacking/IT Incident

   128.6M

2. Theft

   23.5M

3. Loss

   8M

4. Unauthorized Access/Disclosure

   6.7M

5. Other/Unknown

   3.2M

6. Improper Disposal

   961K

^*Some data breaches fall into multiple categories