23 Mar 2016
Cybersecurity is a hot topic in the healthcare arena, with high-profile breaches at Premara Blue Cross and Anthem highlighting the vulnerability of organizations holding high volumes of sensitive information. The U.S. Department of Health and Human Services reported 235 breaches in 2015 involving more than 112 million health records – 100 times more than any other year. And 8 out of 10 of the largest healthcare hacks ever happened last year. To address the issue, the HHS is putting together a Health Care Industry Cybersecurity Task Force as part of the Cybersecurity Information Sharing Act of 2015. Yet in 2016, the biggest threats to healthcare data security so far are something far simpler: theft, misplaced laptops, and even garbage trucks. The HHS Office for Civil Rights’ data breach reporting tool shows that the largest incidents this year involved improper disposal of records and devices leading to millions of records potentially falling into the wrong hands.
- The Radiology Regional Center in Florida found paper records on a Fort Myers street that apparently fell off a truck while in transit to the Lee County Solid Waste Division. The records contained the information of 483,063 patients, including names, addresses, phone numbers, Social Security numbers, dates of birth, health insurance numbers, medical status, and financial information.
- Premier Healthcare in Bloomington, IN reported in March that a laptop went missing for nearly three months, and while forensic analysis showed the laptop was never powered up during this time, the incident had the potential to expose the information of roughly 205,000 individuals.
- Springfield, OH-based Community Mercy Health Partners found a number of patient records in a dumpster, where a business associate had improperly disposed of them. These records contained PII and PHI for more than 113,000 people.
- The Washington State Health Care Authority reported a potential breach affecting more than 91,000 patients when two employees mishandled information by exchanging it through insecure, improper channels.
- Valley Hope Association in Kansas reported that an employee’s laptop was stolen from their car, with a potential 52,076 individuals affected.
- Compliance requirements for third-party vendors, including those responsible for destroying records outside of retention schedules.
- Clarification on where employees can bring laptops and other work-maintained devices, policies for securing such devices, and multi-layered security and encryption of data on such devices.
- Comprehensive procedures regarding the transfer of data.
- Prohibitions on employees bringing specific files outside of the office, whether limiting the type of employee allowed to remove work, the type of documents that can leave, or both.