In July and August, it appeared that there were some signs of progress in terms of how long it took to discover a health data breach. While we’d like to report a new emerging trend, unfortunately the data provided a false sense of improvement. In the same time frame, healthcare has also experienced an uptick in the number of hacking incidents, which are often quickly discovered due to the effect they have on an organization’s daily operations. As a result, some of this improvement may simply be attributable to more hacking, rather than faster discovery, though we’ll be tracking this carefully. Indeed, while hacking is quickly detected, insiders continue to go unnoticed, creating a costly aftermath for both healthcare organizations and patients alike.
July is the first month in 2017 to have hacking incidents outweigh insider breaches to patient data in both frequency and number of affected patient records. While hacking accounted for almost half of total breach incidents this month, the severity and potential damage of insider threats to patient data should not be overlooked, with one incident going undetected for 14 years.
In May, health data breaches continued to be disclosed at a rate of one or more per day, a trend first noted in the 2016 Annual Breach Barometer Report. If the Breach Barometer has taught us anything, it’s not a matter of “if” a healthcare organization will experience a data breach, but simply a matter of “when”. A lot of damage can be done when a breach goes for several years without detection, providing additional time for the information to be disseminated or time for malicious insiders to continue their activities. It is imperative that healthcare organizations educate themselves on what they can do to reduce their risk and detect breaches as soon as they occur.