Q3, 2017 Healthcare Data Breach Report
In Q3, 2017, there were 99 breaches of more than 500 records reported to the Department of Health and Human Services’ Office for Civil Rights (OCR), bringing the total number of data breaches reported in 2017 up to 272 incidents. The 99 data breaches in Q3, 2017 saw 1,767,717 individuals’ PHI exposed or stolen. So far in 2017, the records of 4,601,097 Americans have been exposed or stolen as a result of healthcare data breaches.
Q3 Data Breaches by Covered Entity
Healthcare providers were the worst hit in Q3, reporting a total of 76 PHI breaches. Health plans reported 17 breaches and there were 6 data breaches experienced by business associates of covered entities.
There were 31 data breaches reported in July, 29 in August, and 39 in September. While September was the worst month for data breaches, August saw the most records exposed – 695,228.
The Ten Largest Healthcare Data Breaches in Q3, 2017
The ten largest healthcare data breaches reported to OCR in Q3, 2017 were all the result of hacking/IT incidents. In fact, 36 out of the 50 largest healthcare data breaches in Q3 were attributed to hacking/IT incidents.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
| Covered Entity | Entity Type | Number of Records Breached |
Type of Breach |
| Women’s Health Care Group of PA, LLC | Healthcare Provider | 300,000 | Hacking/IT Incident |
| Pacific Alliance Medical Center | Healthcare Provider | 266,123 | Hacking/IT Incident |
| Peachtree Neurological Clinic, P.C. | Healthcare Provider | 176,295 | Hacking/IT Incident |
| Arkansas Oral & Facial Surgery Center | Healthcare Provider | 128,000 | Hacking/IT Incident |
| McLaren Medical Group, Mid-Michigan Physicians Imaging Center | Healthcare Provider | 106,008 | Hacking/IT Incident |
| Salina Family Healthcare Center | Healthcare Provider | 77,337 | Hacking/IT Incident |
| Morehead Memorial Hospital | Healthcare Provider | 66,000 | Hacking/IT Incident |
| Network Health | Health Plan | 51,232 | Hacking/IT Incident |
| St. Mark’s Surgical Center, LLC | Healthcare Provider | 33,877 | Hacking/IT Incident |
| Sport and Spine Rehab | Healthcare Provider | 31,120 | Hacking/IT Incident |
Main Cause of Healthcare Data Breaches in Q3, 2017
For much of 2017, the main cause of healthcare data breaches was unauthorized disclosures by insiders, although in Q3, 2017, hacking was the biggest cause of healthcare data breaches. These incidents involve phishing attacks, malware and ransomware incidents, and the hacking of network servers and endpoints. These hacking incidents involved the exposure/theft of considerably more data than all of the other breach types combined. In Q3, 1,767,717 healthcare records were exposed/stolen, of which 1,578,666 – 89.3% – were exposed/stolen in hacking/IT incidents.
Location of Breached PHI
If vulnerabilities exist, it is only a matter of time before they will be discovered by hackers. It is therefore essential for HIPAA covered entities and their business associates conduct regular risk assessments to determine whether any vulnerabilities exist. Weekly checks should also be conducted to make sure the latest versions of operating systems and software are installed and no patches have been missed. Misconfigured servers, unsecured databases, and the failure to apply patches promptly resulted in 31 data breaches in Q3, 2017.
In Q3, 34 incidents were reported that involved email. While some of those incidents involved misdirected emails and the deliberate emailing of ePHI to personal email accounts, the majority of those breaches saw login details disclosed or ransomware/malware installed as a result of employees responding to phishing emails. The high number of phishing attacks reported in Q3 shows just how important it is to train employees how to recognize phishing emails and how to report suspicious messages. Training should be an ongoing process, involving classroom-based training, CBT sessions, and phishing simulations, with email updates sent to alert employees to specific threats.
