Law Students

As this post summarizes, based on a recently released report by the Ponemon Institute, data breaches are indeed expensive. The Key findings from 2009 include (editorial comments in blue bold):

• Average total per-incident costs in 2008 were $6.65 million, compared to an average per-incident cost of $6.3 million in 2007.

• The year of over year increase is not that significant but the cost is up $66.00 per record since 2005.
  

• Healthcare and financial services companies experienced the highest churn rate ? 6.5 percent and 5.5 percent respectively, on a total average of 3.6 percent, which reflect the sensitivity of the data collected and the customer expectation that information will be protected.

• In the old healthcare universe many believed that patients were so captive that data breaches would have little impact on the churn. This high percentage of churn in the healthcare industry illustrates that patients are paying attention and will vote with their feet if organizations do not pay sufficient attention to privacy & security (i.e. how long would you keep you $$ at a bank that kept getting hacked?).
  

• Third-party organizations accounted for more than 44 percent of all cases in the 2008 study and are also the most costly form of data breaches due to additional investigation and consulting fees

• The takeaway here is that Business Associate ("BA") contracts will matter A LOT! You are only as secure as your weakest link, and HITECH has caused a veritable explosion in who might be considered a BA.
  

• More than 84 percent of 2008 cases involved organizations that had had more than one data breach in 2008 - meaning that companies are becoming more experienced in managing breaches over time.

• Is there anyone else thinking that more than one data breach might lead to a finding of willful neglect (with penalties at $50,000 per incident)? Should HHS be so inclined they are quite capable of finding lots of instances of willful neglect, especially given the fact that most providers are NOT nearly as compliant as they think (given that HIPAA, in the old universe, was indeed a paper tiger and virtually unenforced). Repeat offenders will give HHS ample opportunity to signal the marketplace that there is a new sheriff in town.
  

• More than 88% of all cases in this year?s study involved insider negligence.

• Insider negligence will continue to play a significant role because, by and large, staff remained woefully under educated regarding privacy and security and, moreover, the appropriate processes have not been put in place.
  

• More than half of respondents believe that training and awareness programs assist in preventing future breaches and 44 percent have expanded their use of encryption.

• Training is necessary but not sufficient to bring these numbers down in any meaningful way. Why? Because HITECH/HIPAA compliance is a people, process and platform (wicked problem) and training only impacts the people prong.

To stay current on the HITECH Act and its quickly changing regulatory scheme visit the HIPAA Survival Guide website and/or sign up for Digital Business Law Group's free monthly compliance newsletter. Also, check out a FREE EHR Checklist and a FREE Online Backup Checklist, both provided from HSG affiliates.