HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

42% of Healthcare Organizations Have Not Developed an Incident Response Plan

Hacks, ransomware attacks, and other IT security incidents account for the majority of data breaches reported to the Department of Health and Human Services’ Office for Civil Rights, but data breaches involving physical records are also commonplace. According to the Verizon Data Breach Investigations Report, disclosed physical records accounted for 43% of all breaches in 2021, which highlights the need for data security measures to be implemented covering all forms of data.

The healthcare industry is extensively targeted by cybercriminals and cyberattacks increased during the pandemic. There was a 73% increase in healthcare cyberattacks in 2020, with those breaches resulting in the exposure of 12 billion pieces of protected health information, according to the 2021 Data Protection Report recently published by Shred-It.

The report is based on an in-depth survey of C-level executives, small- and medium-sized business owners, and consumers across North America and identifies several areas where organizations could improve their defenses against external and internal threats.

Healthcare data breaches are the costliest of any industry at an average of $9.23 million per incident and data breaches such as ransomware attacks put patient safety at risk. 62% of healthcare organizations said they thought a data breach would be costly, with 54% saying a data breach would have a major impact on their reputation. 56% of surveyed healthcare organizations said they have previously experienced a data breach, and 29% said they had experienced a data breach in the previous 12 months.

Get The Checklist

Free and Immediate Download
HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Due to the need to comply with HIPAA, healthcare organizations were better equipped than other industries to prevent and deal with security incidents, with 65% of surveyed healthcare organizations saying they have the appropriate information security tools and resources. While the healthcare industry was significantly more likely than any other industry to have an incident response plan, 42% of respondents said an incident response plan had not been implemented, even though having an incident response plan has been shown to shorten the recovery time and reduce the cost of a data breach.

75% of healthcare organizations said information security is a top priority at their organization, and 61% said they have hired a third-party security expert to evaluate their security practices. However, only 64% employ information security policies, less than half (48%) have regular infrastructure auditing, and only a third (33%) perform vulnerability assessments.

The survey revealed 22% of data breaches were the result of errors by employees. The biggest barriers to employees following information security policies and procedures were a lack of understanding of the threats and risks (49%), lack of accessibility or understanding of policies (41%), and a lack of consistent training and security awareness programs (10%).

While the healthcare industry is better prepared than many other industries, the survey shows there is significant room for improvement. Shred-It suggests healthcare organizations should develop a comprehensive plan covering all data, employ a data minimization strategy, take advantage of the cloud, invest in endpoint detection and response technology, develop an incident response plan, and encrypt all data on-premises, in the cloud, and in transit.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.