Email is now the top source of healthcare breaches

Nearly 200 million people in the U.S. have had their health information exposed in data breaches since 2010, according to federal data.

That number’s only going up.

In 2018, 13 million people had their health data exposed in 366 breaches. That’s up 2% from the 359 breaches providers, health plans and their business associates reported in 2017. 

“The trend we’re seeing based on an incidence perspective … is that breaches have continued to get worse,” said Robert Lord, co-founder and president of cybersecurity company Protenus.

There’s been a marked increase in email breaches in recent years. Since 2017, email has been the primary outlet through which health data is exposed. That year, there were 85 email breaches—more than double the number reported in 2016—accounting for nearly one-quarter of all healthcare breaches.

More data is flowing electronically today than a few years ago, according to Mari Savickis, vice president of federal affairs at the College of Healthcare Information Management Executives.

In previous years, healthcare organizations and their business associates were more likely to attribute breaches to theft of paper records or laptops.

Many email breaches stem from phishing, a tactic in which hackers obtain sensitive data by posing as a trusted entity, such as the recipient’s employer. 

To bolster online security, Savickis suggested healthcare organizations appoint a dedicated chief information security officer and regularly educate staff on how to recognize potential threats.