A new report reveals that in 2013, the number of protected health information (PHI) breaches were up 138 percent from 2012, with 199 incidents of breaches of PHI reported to the Department of Health and Human Services (HHS) impacting over 7 million patient records.
The report, the fourth annual from Redspin, Inc., a Carpinteria, Calif.-based provider of IT security assessments, revealed that nearly 30 million Americans have had their health information breached or inadvertently disclosed since 2009. Since the Health Information Technology for Economic and Clinical Health (HITECH) Act forced providers to notify HHS when they had a breach affecting 500 or more patients, there have been 804 large breaches of PHI.
Last year, in particular, was rough for providers. Over the course of four years, only one year has been higher in terms of total incidents and number of patients impacted.
"I think the 138 percent increase in patient records breached caught a lot of people by surprise," Daniel W. Berger, Redspin's President and CEO, said in a statement. "There was a sense that the government's 'carrot and stick' approach – requiring HIPAA security assessments to qualify for meaningful use incentives and increasing OCR enforcement initiatives – was driving real progress."
The five largest PHI breaches made up more than 85 percent of the total reported from the year. This includes the Advocate Health and Hospitals breach, where four desktop computers from an office were stolen, that affected more than four million patients. The second and third largest breaches were also caused by theft. In total, theft was the cause of nearly half of all breaches in 2013.
Laptops were the device on which the highest number of data breaches occurred, being involved in nearly 35 percent of all incidents. The lack of encryption on portable devices, the authors of the report say, is one of the highest risks to PHI.
"It's only going to get worse given the surge in the use of personally-owned mobile devices at work," Berger said. "We understand it can be painful to implement and enforce encryption but it's less painful than a large breach costing millions of dollars."
One positive area in the report was the impact of the HIPAA Omnibus Rule on covered entities and business associates (BAs). While the number of breach incidents involving BAs followed the norm in 2013, the number of patient records dropped dramatically from 2009-2012.
