Pennsylvania Hospital Advises of Data Breach
Penn Highlands Brookville has issued a public notice confirming a recent “data security incident”, which the Pennsylvania Hospital says involved the data of 4,500 patients under the care of Barry J. Snyder, M.D. The statement was issued as a PHIprivacy press release.
Penn Highlands Brookville is part of a quartet of Dubois, PA hospitals comprising Penn Highlands Healthcare, although this incident only affected one doctor’s patient database.
On August 14, 2014 a server containing Barry J. Snyder’s patient database was found to have been compromised. A third party had gained access to the server on which the data was stored and potentially had access to protected health data of all of the doctor’s patients.
It could not be determined whether the intruder had actually accessed any of the patient data. The data was held on a server belonging to an Ohio third party vendor under contract to maintain Dr. Snyder’s records.
The data stored on the server included names, addresses, social security numbers, medical and insurance information, driver’s license numbers, telephone numbers and the patient birthdates.
The announcement was made to alert patients to a potential risk to their privacy and to give them the opportunity to take action to protect their identities. Following the discovery of the data breach the hospital arranged for the data to be moved from the affected server and transferred to a secure data storage facility.
HIPAA guidelines cover the storage of protected patient data and stiff fines are applicable for data breaches. This incident raises again the question of offsite storage and maintenance of patient data by non-healthcare organizations and the cyber security risks involved.
According to ClearDATA, in 2013 44% of data breaches affected the healthcare industry, with it rising to the top of the list for the first time. Data breaches cost an estimated $5.6 billion a year. The rise of 138% year on year has been attributed to the value of patient data, which is much more attractive to cybercriminals than credit card and social security numbers, although the latter is also stored in patient databases.
The increased cyber security risk necessitates measures being taken to protect data such as ensuring both data storage and transmission is appropriately encrypted.
