The privacy promise

When Congress introduced the Health Insurance Portability and Accountability Act (HIPAA) in 1996, proponents hailed it as an assurance of stringent security and privacy for patient information. The Department of Health and Human Services (HHS) planned to oversee performance of the hospitals, insurers, and related organizations that served as stewards of millions of personal medical records.

Breaches begin

However, as growing amounts of medical information were digitized and placed online, hackers and other malefactors began to breach systems that held the data. In 2010, HHS counted about 200 major data breaches. Over the course of the next several years, HIPAA-related data hacks continued their upward trend, reaching 510 in 2019.¹ 

It’s interesting to note that HIPAA opted to count only those hacks that involved 500 or more patient records. We can only speculate as to how many smaller attacks went unreported.

Criminal allure

Few documents in contemporary life are as comprehensive and intimate as medical records and other protected health information (PHI). Each may hold significant details of a person’s medical history, including physician appointments, lab tests, diagnoses, prognoses, medications, supplements and prescriptions.

Other data commonly specifies a patient’s employment history, insurance, credit cards, bank accounts, social security number, demographics, past addresses and names of relatives.