by
Lauren Dubinsky, Senior Reporter | April 15, 2015
From 2010 to 2013, the number of data breaches involving protected health information reported by HIPAA-covered entities rose from 214 to 265, according to a new study conducted by the Kaiser Division of Research. The results were published in JAMA.
The researchers looked at an online database maintained by the U.S. Department of Health and Human Services that involved information on data breaches on unencrypted protected health information, reported by clinicians and health plans covered under HIPAA. The breaches included in the study had to affect 500 individuals or more from 2010 to 2013, which ended up being 82 percent of all of the reports.
They found that 949 breaches affected about 29 million records during that time period and six of those individual breaches involved over one million records. California, Texas, Florida, New York and Illinois made up 34 percent of the breaches.
The majority of the breaches — 67 percent — happened through electronic media including laptop computers and portable electronic devices. Most of the breaches took place through theft — 58 percent — and the rate of breaches resulting from hacking, unauthorized access or disclosure rose from 12 percent in 2010 to 27 percent in 2013.
Because there has been a rapid adoption of EHR technology since 2012, and cloud-based services for predicative analytics, personal health records, health-related sensors and gene sequencing technology are anticipated to increase, the researchers believe that the occurrence and extent of data breaches will likely increase.
In addition, the study was restricted to data breaches that were already known, reported and impacting at least 500 individuals, so the researchers believe that the study possibly underestimated the real amount of breaches that occurred every year.
In a related editorial, Dr. David Blumenthal of the Commonwealth Fund and Deven McGraw of Manatt Phelps & Phillips LLP explained that if patients are worried that their digital health information will be compromised, they will refrain from sharing it electronically. As a result, that will lessen its value in their care and limit its accessibility for research and performance measurement.
"The stakes associated with the privacy and security of personal health information are huge,” they wrote. “Threats to the safety of health care data need much more focused attention than they have received in the past from both public and private stakeholders."
Back to HCB News
