The Health Insurance Portability and Accountability Act (HIPAA) is a regulation for healthcare providers to keep patient healthcare information (PHI) protected. Despite it being 20 years since the passing of HIPAA, there has been a continuous stream of PHI breaches. When a data breach does occur, a healthcare provider usually suffers huge damages in fines, loss of credibility, as well as money for related lawsuits.

Read: The Three Safeguards of the HIPAA Security Rule Summarized

In the event a breach does occur, the office of Civil Rights (OCR) for the Department of Health and Human Services (HHS) investigates in order to discern the cause and whether or not the breach was caused by willful neglect. During this process, the covered entity must provide a settlement payments and a resolution agreement that covers their concrete action plan as well as a proposal for updating policies and procedures so that breaches of the same nature will not happen again in the future. The OCR then monitors their activity for a general period of 3 years to make sure they are performing their agreed upon obligations. If it is discovered that the covered entity is failing to meet the agreed upon resolution obligations, it can result in large civil money penalties for noncompliance.

The HHS provides some example settlement cases as well as resolutions agreements for those cases. From the 23 separate cases that the HHS has provided, settlements totaled $25.9 million which averages out to around $1.2 million per case. The cases are summarized in the table below:

As seen by the table, data breaches occurred in both small and large covered entities and even public government organizations such as the Skagit County Government case. There was even a case where, for the first time, there was a settlement where less than 500 individual patients were involved for $50,000. To put it simply, breaches are independent of the size of the firm and the HHS is cracking down on relatively smaller sized breaches as well. So it is important to be aware of even the smallest chances of having a security breach in order to be able to effectively prevent or respond to it.

Read: The Primary Threats to Data Breaches of Protected Healthcare Information (PHI)

Also, around 2012, the breach cases start to be ePHI related breaches which is most likely due to the HITECH Act, which pushed for the transition to electronic health records by 2014. Many of these breaches involve easily avoidable situations such as losing unencrypted laptops and USB flash drives, improperly disposing of data, and technical mishaps such as leaving ePHI open to the public. Simple dumb mistakes can be extremely costly for covered entities with settlements that can be well over a million dollars.

Also, the HHS only disclosed information in regards to the settlement amount and does not mention the other costs associated with HIPAA data breaches. According to Ponemon Institute’s Fourth Annual Benchmark Study on Patient Privacy & Data Security, the average cost per data breach was approximate $2 million (which is almost double average settlement amount from the above table) with a potential cost for the entire healthcare industry at $5.6 billion annually. Some examples are the costs for the investigation after a breach, costs to prepare and implement the proposed action plan, cost of implementing new technology, or even the damages caused to a covered entities reputation. So simply put, the settlement is only the tip of the iceberg for costs associated with HIPAA breaches.

Despite HIPAA being in place, covered entities are still having issues with ePHI associated data breach. Many, if not all, of these cases could have been easily prevented, saving the covered entity millions in settlement costs and associated costs. So instead of paying millions for data breach recovery, why not simply encrypt all data and storage devices? Why not just restrict unauthorized people from accessing data? Why not just wipe data off old devices? Why not just properly train employees? In the long run, it would be easier to do and would be a much more cost-effective option.

Blogs relating to HIPAA
Ways to Prevent HIPAA Data Breach by Insiders
Insiders: the Most Frequent Reason for HIPAA Data Breach
The Primary Threats to Data Breaches of Protected Healthcare Information(PHI)
The Three Safeguards of the HIPAA Security Rule Summarized