According to a report, October 2019 was the month with the most breaches data in the healthcare sector (or at least the most officially recorded).
In total, approximately 40 million records health-related and data have been exposed throughout the year due to a hacking attack .
In October alone, there were 52 data breaches affecting hundreds of thousands of medical records, according to the U.S. Department of Health and Human Services (HHS).
This number is the largest recorded in a single month since January 2014, and affected 661,830 files.
According to the HIPAA Journal, the number of exposed, lost or stolen medical records by the end of October exceeded 38 million.
This number is impressive, considering the data breaches of the last three years. It is three times the number of breaches recorded in 2018 and seven times the number recorded in 2017.
However, the year with the most breaches recorded was 2015. In 2015, health insurance companies Anthem and Premera Blue Cross were breached, resulting in the leakage of personal data of 78.8 million and 11 million customers respectively.
In October, multiple healthcare services and healthcare-related businesses in 24 states reported breaches of their customers' data. Seventeen incidents (the most) occurred in Texas.
The two organizations with the largest data losses, due to a breach, were Betty Jean Kerr People's Health Centers with 152,000 exposed data and Kalispell Regional Healthcare with 140,209 exposed records.
However, Betty Jean's case was different, as the files were not exposed online or to a third party. They were encrypted after a ransomware attack.
The organization decided not to pay the ransom, but it was also unable to recover the encrypted files from backups. Thus, the data was lost.
According to analyses, 28 of the breach incidents were caused by unauthorized access to healthcare services' systems, while 18 of them came from hacking attacks.
The above numbers clearly show that hospitals and healthcare services in general are an attractive and easy target for hackers.
The U.S. Department of Health and Human Services' Office for Civil Rights (OCR) has issued financial penalties for some of the services affected by data breaches, as they failed to adequately protect their customers' personal data.
