Fewer patients had health data exposed in December-reported breaches

Nearly 300,000 individuals had data exposed in healthcare breaches reported to the federal government in December—the lowest number of people affected by healthcare breaches in a single month last year.

Providers, health plans and their business associates in December reported 30 breaches affecting 295,141 patients to HHS' Office for Civil Rights, the agency that maintains the government's database of healthcare breaches. In terms of patients affected, that's down 48% from December 2018, when organizations reported 25 breaches affecting 566,963 people.

In January, the 2019 month with the second-lowest number of impacted individuals, healthcare organizations reported 35 breaches exposing data on 577,511 people.

July saw the greatest number of individuals affected by healthcare breaches last year at 26.7 million.

A breach at a health system in Missouri—the result of a car break-in—was the only incident reported to the OCR in December that affected more than 100,000 people. In November, by contrast, healthcare organizations reported three breaches each compromising data from more than 100,000 people.

The Missouri health system Truman Medical Centers in July learned that items, including a password-protected work laptop, had been stolen from an employee's car. During an investigation into the incident, the health system determined that protected health information from 114,466 patients had been stored on the laptop, including some patient names, dates of birth, Social Security numbers and limited treatment information.

However, "there is no evidence that anyone accessed, viewed or misused any patient information," the health system wrote in a notice posted online.

Theft incidents, like the one at Truman Medical Centers, were uncommon sources of breaches reported last month, accounting for just two of the 30 breaches submitted to the OCR. Hacking and IT incidents comprised most of breaches reported, at 53%. Eighty-one percent of the hacking and IT incidents targeted email addresses.

The remaining breaches reported in December resulted from loss, unauthorized access or unauthorized disclosure.