The Department of Health and Human Services recently submitted its annual report to Congress about breaches of unsecured protected health information for 2011 and 2012, writes Patricia Wagner, Ali Lakhani and Jonathan Hoerner in Epstein Becker & Green’s TechHealth Perspectives blog. “This report provides valuable insight for health-care entities regarding their data security and enforcement priorities,” they say.
Here are some of their top takeaways:
- Health-care providers accounted for the majority of breaches in both years: For health-care data breaches that affected 500+ people, providers came in first. Of all the breaches, providers accounted for 63 and 68 percent in 2011 and 2012, respectively, whereas business associates accounted for 27 and 25 percent, respectively, and health plans 10 and 7 percent, respectively.
- Protected health information was the leading cause of breaches in both 2011 and 2012: Theft comprised approximately 50 percent of the breaches in both years, whereas loss was at 17 and then 12 percent, unauthorized access 19 and 18 percent, and hacking incidents 8 percent in 2011 and up to 27 percent in 2012.
- Recommendations: To protect health-care entities from major breaches, the authors suggest encrypting devices, paying attention to physical control of devices, and removing data before disposing of old ones.
