Introduction to Breach Data

The US Department of Health and Human Services are responsible for collecting protected health data and they have to report if any incidents happen. This data will look at all the breaches that have happened within the Department of Health and Human Services. The goal of this data is to see how much of an impact the breaches caused and it can look at ways to detect a breach happening.

Summary Table of Breaches

In this table, we are going to break down the data into a few categories to get a better look at what it means. These are general stats about how many records there are, how many people affected, and then a break down of some of the more common breaches. Hacking and Unauthorized Incidents were two of the most common incidents that occurred to individuals. As the table goes on, we can see the percentage of people that have been hacked or have had an unauthorized incident.

Number of records How many Individuals were affected How many Individuals were affected by an Unauthorized Incident What percent of Breach Incidents were caused by an Unauthorized Incident How many individuals were effected by Hacking What percent of Breach Incidents were caused by Hacking
1709 124249678 5566337 0.2480983 87385368 0.1287303

Number of healthcare data breaches per year

In this graph we are going to break down how many breaches happened each year since 2009-2018.

In the first three years there were not as many breaches and then in 2013 it increased and continued to increase in 2014. In 2014 the healthcare breaches peaked having the most breaches. We can assume that after 2014 there was tighter security on healthcare records and that continued in the years after.

Top 25 Largest data breaches that affected the most people

This table will show the 25 largest data breaches that have affected the most people. It looks at the name of the Covered Entity, Breach Year, Type of Entity, Individuals Affected, and Type of Breach. The biggest data breach that affected most individuals was the Anthem, Inc Breach in 2015. This is the largest breach by millions of the other most common breaches. This table shows how much of an impact only one breach can do for a company and how many individuals had exposed health records because of the incident.

Name of Covered Entity Breach Year Covered Entity Type Individuals Affected Type of Breach
Anthem, Inc. Affiliated Covered Entity 2015 Health Plan 78800000 Hacking/IT Incident
Science Applications International Corporation (SA 2011 Business Associate 4900000 Loss
Advocate Health and Hospitals Corporation, d/b/a Advocate Medical Group 2013 Healthcare Provider 4029530 Theft
21st Century Oncology 2016 Healthcare Provider 2213597 Hacking/IT Incident
Xerox State Healthcare, LLC 2014 Business Associate 2000000 Unauthorized Access/Disclosure
IBM 2011 Business Associate 1900000 Unknown
GRM Information Management Services 2011 Business Associate 1700000 Theft
AvMed, Inc. 2010 Health Plan 1220000 Theft
Montana Department of Public Health & Human Services 2014 Health Plan 1062509 Hacking/IT Incident
The Nemours Foundation 2011 Healthcare Provider 1055489 Loss
BlueCross BlueShield of Tennessee, Inc. 2010 Health Plan 1023209 Theft
Sutter Medical Foundation 2011 Healthcare Provider 943434 Theft
Valley Anesthesiology Consultants, Inc. d/b/a Valley Anesthesiology and Pain Consultants 2016 Healthcare Provider 882590 Hacking/IT Incident
Horizon Healthcare Services, Inc., doing business as Horizon Blue Cross Blue Shield of New Jersey, and its affiliates 2014 Business Associate 839711 Theft
Iron Mountain Data Products, Inc. (now known as 2010 Business Associate 800000 Loss
Utah Department of Technology Services 2012 Business Associate 780000 Hacking/IT Incident
AHMC Healthcare Inc. and affiliated Hospitals 2013 Healthcare Provider 729000 Theft
EISENHOWER MEDICAL CENTER 2011 Healthcare Provider 514330 Theft
Radiology Regional Center, PA 2016 Healthcare Provider 483063 Loss
Puerto Rico Department of Health - Triple S Management Corp. 2010 Health Plan 475000 Unauthorized Access/Disclosure
St Joseph Health System 2014 Healthcare Provider 405000 Hacking/IT Incident
Spartanburg Regional Healthcare System 2011 Healthcare Provider 400000 Theft
Triple-S Salud, Inc. - Breach Case#2 2014 Health Plan 398000 Theft
Triple-S Salud, Inc. 2010 Health Plan 398000 Theft
Community Health Plan of Washington 2016 Health Plan 381504 Hacking/IT Incident

The biggest data breach that affected most individuals was the Anthem, Inc Breach in 2015. This is the largest breach by millions of the other most common breaches. This table shows how much of an impact only one breach can do for a company and how many individuals had exposed health records because of the incident.

Total health care records exposed by states

There is no state that is safe from breaches, but there are some states that have breaches happen more often. This graph will show the top breach incidents that have happened in each state. We can see that Indiana has had the highest amount of individual’s records exposed because of data breaches.

Number of healthcare breaches cause by hacking by month

Now we will take a deeper look at when breaches are most likely to happen. This graph will look at breaches that happen each month that are by hacking. Hacking is one of the most common forms of breaches and can affect many individuals. We can see that most breaches that happened by hacking are in April. March, April, and May are the highest group of months that have had reported hacking incidents, and December, January, and February are the months with the least amount of hacking breaches, we can assume that most hacking incidents will happen in the spring

## 2.1.5 Table: “Number of breaches by covered entity type”

In this table we are looking at which type of covered entity was used the most. Healthcare provider is the most covered entity type and has had the most breaches. As expected, majority of the breaches that have happened were a healthcare provider.

Covered Entity Type Number of Breaches
Healthcare Provider 1220
Business Associate 285
Health Plan 200
Healthcare Clearing House 4

What years had at least 50 breaches with a covered entity type and at least 150 breaches from a healthcare provider covered entity type

When looking at each year more in depth, we want to look at the year that had at least 50 breaches with a business associate covered entity and 150 breaches of a healthcare provider. We want to look at these years because these can be the years that have had the most breaches happen. In the table we can see that only 2013 and 2014 have had at least 50 breaches with a business associate covered entity and 150 breaches of a healthcare provider covered entity. These two years are the years that have had the most breaches happen.

Breach Year Business Associate Healthcare Provider
2013 64 187
2014 67 179

Which type of entity covered the most breaches per year

This table looks at each year and displays what covered entity that they have. We can look and see which year has had the most and make comparisons to other years.

2009 2010 2011 2012 2013 2014 2015 2016 2017 2018
Business Associate 3 43 45 37 64 67 9 14 3 0
Health Plan 1 21 17 22 17 38 34 36 14 0
Healthcare Clearing House 0 0 1 1 2 0 0 0 0 0
Healthcare Provider 14 134 132 148 187 179 155 182 88 1

As stated earlier we can see that in 2013 and 2014 they had the most growth in the business associate covered entity. This was a huge increase from the years prior. Although it is nice to see this as a table, it can make more sense looking at a graph.

In the graph we can more visually see each year and the covered entity that was used the most. It is obvious to see that Healthcare providers are the most common but lets look at it without that in the graph to get a better look at the smaller entities that do happen because these can still affect numerous individuals.

Now this gives us a clearer look at the other three covered entities. You can see that these entities are still affecting numerous people. All of the breaches that happen affect individuals weather it be a numerous amount of people or small amount. It is still the Job of the US Health and Human Services Department to make sure that healthcare information is safe from all breaches.

Looking back at Indiana

Previously we looked at the top 10 states that had the most breaches happen to them. We determined that Indiana was the state with the largest number of individuals affected. Lets look at the break down of Indiana each year in a table to see if there is an incident that happened causing the data to be skewed.

BreachYear Individuals Affected
2017 1239
2016 221624
2015 78870391
2014 68300
2013 219762
2012 117221
2011 41142
2010 37086

In this table we can see a large increase in 2015 leading to have the data be skewed in a graph. We can see that in 2015 they had the largest case of breaches (stated earlier in Top 25 Largest breaches) leading to a 78 million increase. If we want to look at this closer we can eliminate 2015 and look at the other years.

Now we have a better look at the individuals affected each year. Indiana has only had the one incident leading them to be the top state with the most individuals affected. Indiana is pointed as the state that has had the most individuals affected but it is in part of that one year. Every breach matters no matter how many individuals are affected, one bad breach made Indiana the state with the most individuals affected by breaches.