{"id":4484,"date":"2014-01-23T00:21:00","date_gmt":"2014-01-23T00:21:00","guid":{"rendered":"https:\/\/www.healthlawpolicymatters.com\/?p=4484"},"modified":"2021-11-03T00:21:59","modified_gmt":"2021-11-03T00:21:59","slug":"the-data-breach-wall-of-shame-2013s-highlights","status":"publish","type":"post","link":"https:\/\/www.healthlawpolicymatters.com\/2014\/01\/23\/the-data-breach-wall-of-shame-2013s-highlights\/","title":{"rendered":"Data Breach Wall of Shame: 2013\u2019s Highlights and Lessons"},"content":{"rendered":"\n<p>Since 2009, the HHS Office for Civil Rights (\u201cOCR\u201d) has posted all large data breaches \u2013 those that involve 500 or more individuals \u2013 online on its so-called\u00a0<a href=\"https:\/\/ocrportal.hhs.gov\/ocr\/breach\/breach_report.jsf\" target=\"_blank\" rel=\"noreferrer noopener\">\u201cWall of Shame.\u201d\u00a0<\/a>\u00a0In 2013, 160 large data breaches were reported to OCR and posted on the Wall of Shame. \u00a0Taken together,\u00a0<strong>these breaches involved the unsecured protected health information (\u201cPHI\u201d) of nearly 6.85 million individuals.<\/strong><\/p>\n\n\n\n<p>The following top five breaches of 2013 accounted for over 88% of all individuals affected by large data breaches in that year:<\/p>\n\n\n\n<ul><li><a href=\"http:\/\/www.advocatehealth.com\/body_full.cfm?id=12&amp;action=detail&amp;ref=293\" target=\"_blank\" rel=\"noreferrer noopener\">Advocate Health and Hospitals Corp<\/a>. (4,029,530);<\/li><li><a href=\"http:\/\/honeywell.horizonblue.com\/important-notice-regarding-laptop-thefts\" target=\"_blank\" rel=\"noreferrer noopener\">Horizon Healthcare Services, Inc. d\/b\/a Horizon Blue Cross Blue Shield of New Jersey and its affiliates<\/a>\u00a0(839,711);<\/li><li><a href=\"http:\/\/oag.ca.gov\/system\/files\/AHMC%20Press%20Release_10-21%20revised_0.pdf\" target=\"_blank\" rel=\"noreferrer noopener\">AMHC Healthcare Inc<\/a>. (729,000);<\/li><li>Texas Health Harris Methodist Hospital Fort Worth\u00a0(277,014); and<\/li><li><a href=\"http:\/\/www.in.gov\/activecalendar\/EventList.aspx?view=EventDetails&amp;eventidn=109586&amp;information_id=183960&amp;type=&amp;syndicate=syndicate\" target=\"_blank\" rel=\"noreferrer noopener\">Indiana Family &amp; Social Services Administration\u00a0<\/a>(187,533).<\/li><\/ul>\n\n\n\n<p>Of these five breaches, one breach involved the PHI of over four million individuals; the other four breaches each affected over 150,000 individuals.&nbsp; Three out of these five breaches resulted from the theft of equipment or electronic files with unencrypted PHI. The two remaining breaches were due to errors by business associates: one that failed to destroy microfiches containing PHI that ultimately ended up in several local parks; and one that made a computer programming error and transmitted records to an unintended party. Interestingly, the first incident involved the PHI of patients seen by the facility between 1980 and 1990, demonstrating that older PHI is no safer from improper disclosure than newly generated PHI.<\/p>\n\n\n\n<p>These incidents from 2013 should alert covered entities, business associates, vendors and other agents handling PHI to the following lessons:<\/p>\n\n\n\n<ol><li><strong>Encrypt, encrypt, and encrypt again<\/strong>&nbsp;\u2013 in&nbsp;one of the&nbsp;breaches, the hospital system had focused on encrypting their laptops, but had not yet completed encrypting the desktops that contained PHI;<\/li><li><strong>Monitor where PHI is going<\/strong>\u2013 if (or when) PHI gets inadvertently transmitted to the wrong party, knowing where it went will help the breaching party to perform an adequate risk assessment under 45 C.F.R. 164.402(2); and<\/li><li><strong>Follow up (and follow through) on the destruction of PHI<\/strong>&nbsp;\u2013 having policies on how to properly protect or destroy older PHI records and following up with entities entrusted with completing those tasks will lessen the risk that these records will cause a future breach down the road.<\/li><\/ol>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Since 2009, the HHS Office for Civil Rights (\u201cOCR\u201d) has posted all large data breaches \u2013 those that involve 500 or more individuals \u2013 online on its so-called\u00a0\u201cWall of Shame.\u201d\u00a0\u00a0In 2013, 160 large data breaches were reported to OCR and posted on the Wall of Shame. \u00a0Taken together,\u00a0these breaches involved the unsecured protected health information &#8230; <a title=\"Data Breach Wall of Shame: 2013\u2019s Highlights and Lessons\" class=\"read-more\" href=\"https:\/\/www.healthlawpolicymatters.com\/2014\/01\/23\/the-data-breach-wall-of-shame-2013s-highlights\/\" aria-label=\"More on Data Breach Wall of Shame: 2013\u2019s Highlights and Lessons\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_generate-full-width-content":"","footnotes":""},"categories":[1],"tags":[],"_links":{"self":[{"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/posts\/4484"}],"collection":[{"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/comments?post=4484"}],"version-history":[{"count":3,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/posts\/4484\/revisions"}],"predecessor-version":[{"id":4487,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/posts\/4484\/revisions\/4487"}],"wp:attachment":[{"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/media?parent=4484"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/categories?post=4484"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.healthlawpolicymatters.com\/wp-json\/wp\/v2\/tags?post=4484"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}