Security breaches among healthcare organizations are soaring. That's the conclusion of the Second Annual Benchmark Study on Patient Privacy and Data Security conducted by the Ponemon Institute and sponsored by ID Experts.
A total of 72 healthcare organizations where surveyed, and, on average, the cost of data breaches to these organizations rose $183,526 to $2,243,700 from 2010. The absolute number of breaches are also increasing: up 32 percent year over year, with 96 percent of those providers surveyed reporting at least one data breach in the past 24 months.
Also see: Why healthcare IT security is harder than the rest
Extrapolating the study to the entire healthcare industry, Ponomon estimates that data breaches could be costing the U.S. healthcare industry between $4.2 billion and $8.1 billion a year, or an average of $6.5 billion.
The majority of these breaches weren't caused by sophisticated hacks or so-called advanced persistent threats. No. Most of the breaches, the survey found, were the result of employees losing or having their IT devices stolen or other unintentional, but ill-advised, employee action according to 49 and 41 percent of respondents. Shoddy security from partners and providers, including business associates, according to 46 percent of participants, was another significant reason.
There was some good news from the study: the percentage of respondents who had breaches discovered by their patients dropped from 41 percent to 35 percent.
The reason for the increase in breaches overall? There could be a number of factors, says Larry Ponemon of the Ponemon Institute, such as an increase in the use of IT in the health care industry and more attacks targeting that electronic medical information. Perhaps an increase in regulatory demands is causing healthcare organizations to look more closely for breaches, and so they're finding more. Or, perhaps, the reason for the increase is a mix of each of those trends, Ponemon said.
Once a breach is discovered, 83 percent of hospitals reported it taking one to two months to notify affected patients. Nearly a third, or 29 percent, admitted that breaches lead to cases of identity theft, a figure that rose 26 percent from the previous year.
"It's easy to lose sight on what big numbers like $6.5 billion annually mean," says Rick Kam, president and co-founder of ID Experts. "But that's enough money to pay the salaries of an additional 81,000 registered nurses a year."
A copy of the survey is available. Registration is required.
George V. Hulme writes about security and technology from his home in Minneapolis. You can also find him tweeting about those topics on Twitter at @georgevhulme.
Read more about data privacy in CSOonline's Data Privacy section.