Pursuant to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), covered entities (e.g. healthcare providers and health plans) must notify the Department of Health and Human Services (“HHS”) of breaches of unsecured protected health information (“PHI”).1 The information provided to HHS provides organizations with a high level of insight concerning the types of breaches that occur in the healthcare industries.
The data collected by HHS concerning breaches affecting 500 or more individuals in 2014 shows that low-tech breaches remain the most common form of data loss in the health sector – surpassing more publicized hacking events.
Things to consider when reviewing your information security program in light of HHS data:
-
Are all laptops encrypted?
-
Is laptop encryption full-disk (e.g., does it apply to the entire hard drive)?
-
Is laptop encryption also file-level (e.g., would it apply if files were removed from the hard drive)?
-
Do you permit other types of portable media in your environment like USB drives?
-
If so, are those devices encrypted at the disk or file-level?
-
Are passwords enforced on laptops and other types of portable media?
The following provides a snapshot of information concerning healthcare data breaches.
46%
The quantity of breaches caused by theft of hardware of all types.2
|
34%
The quantity of theft involving stolen laptops.3
|
9%
The quantity of breaches caused by hacking/IT intrusions.4
|
3%
The quantity of breaches caused by improper disposal.5
|
[1] 45 C.F.R. §164.408(a)-(b).
[2] U.S. Dep't of Health and Human Servs. Office for Civ. Rights, Breaches Affecting 500 or More Individuals, https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf.
[3] Id.
[4] Id.
[5] Id.
[View source.]
