SecurityWeek has conducted an analysis of the healthcare breach database maintained by the US Department of Health and Human Services Office for Civil Rights (HHS OCR), which stores information on incidents impacting the protected health information of over 500 individuals.
The OCR was informed about 720 incidents between January 1, 2024, and December 31, 2024. Adding up the numbers from each breach suggests that roughly 186 million people are impacted.
Impacted information can include names, contact details, dates of birth, Social Security numbers, insurance information, medical information, and even financial information.
Of the total number of data breaches, approximately 520 affected healthcare providers. Another commonly impacted type of entity was healthcare business associate, which accounted for 120 incidents. Health plans were involved in nearly 100 incidents.
Close to 600 incidents were described as ‘hacking/IT incident’, which includes ransomware attacks. The second most common type of incident involved unauthorized access or disclosure.
Roughly 450 breaches involved network servers, and roughly 160 involved email, which is typically used by threat actors for phishing and malware delivery.
The OCR database also keeps track of the state where the impacted organization is located. Texas and California accounted for the highest number of incidents (roughly 60 each), followed by New York (46), Illinois (43), Florida (37), Pennsylvania (31), Ohio (29), Massachusetts (29), Tennessee (25) and Michigan (22).
The biggest healthcare data breach of 2024 impacted Change Healthcare. A ransomware attack aimed at the company resulted in the information of roughly 100 million individuals getting stolen.
The list of organizations impacted by major data breaches also includes Kaiser Permanente (13.4 million), Ascension Health (5.5 million), HealthEquity (4.3 million), Concentra Health Services (3.9 million), Centers for Medicare & Medicaid Services (3.1 million), Acadian Ambulance Service (2.8 million), A&A Services, dba Sav-Rx (2.8 million), WebTPA (2.5 million), and Integris Health (2.3 million).
HIPPA Journal reports that between 2009 and 2023, 5,887 healthcare data breaches of 500 or more records were reported to OCR. Those breaches have resulted in the exposure or impermissible disclosure of 519,935,970 healthcare records. That equates to more than 1.5x the population of the United States. In 2018, healthcare data breaches of 500 or more records were being reported at a rate of around 1 per day. Fast forward 5 years and the rate has more than doubled. In 2023, an average of 1.99 healthcare data breaches of 500 or more records were reported each day, and on average, 364,571 healthcare records were breached every day.
John Riggi, national adviser for cybersecurity and risk at the American Hospital Association was quoted by Modern Healthcare as saying “I have never seen the healthcare sector so engaged in cybersecurity,” he said, “from the [C-suite] level all the way down to operational staff.”