The number of data breaches affecting healthcare providers declined in the second half of 2022, but the number of individual records exposed by these breaches increased by 35%, a new report said.
Supporting data comes from Critical Insight, a cybersecurity-as-a-service provider specializing in helping critical organizations prepare, detect, and respond to the threat environment. The company’s H2 2022 Healthcare Data Breach Report analyzes breach data reported to the U.S. Department of Health and Human Services by healthcare organizations.
Healthcare Breach Data Examined
Despite the fact that the volume of data breaches hitting the healthcare market slid in the second half of 2022, consistent with a downward trend over the past two years, current breach totals:
- Remain higher than pre-pandemic levels
- Are affecting more individuals
- Hackers shifting tactics to attack weak links in the healthcare system supply chain, most notably attacking electronic health records (EHR) systems
John Delano, Critical Insight healthcare cybersecurity strategist, emphasized that as the cybersecurity landscape shifts, organizations must strive to stay ahead of the curve:
"Our latest H2 2022 Healthcare Breach Report highlights the shifting tactics of attackers, who are now targeting smaller entities with weaker cyber defenses. Organizations must stay vigilant and proactively defend against these threats to protect patient data and maintain the trust of their patients and the public."
A Closer Look at the Report
The report’s key findings include:
- Fewer but more significant breaches reflect consolidation within the industry and the evolving tactics of attackers.
- Total breaches dropped 9% between the first six months of 2022 and the year's second half, declining since a high-water mark at the height of the pandemic from 393 breaches in the second half of 2020 to 313 in the latest reporting period.
- The number of individual records exposed by breaches skyrocketed by 35% in the second half of 2022 to hit 28 million.
- Healthcare organizations have done an excellent job of shoring up their policies around handling and storing medical records. Hacking accounted for 79% of all incidents and 84% of individual records exposed in 2022.
- On average, the number of individuals affected per unauthorized access/disclosure breach spiked from 5,700 in the first half of 2022 to over 143,000 in the second half. By comparison, the average number of individuals affected per hacking breach grew from 73,900 to 87,000 in 2022.
- Attackers continue to attack hospitals but have found increasing success targeting business associates and third-party vendors such as electronic medical record providers, lawyers, accountants, billing companies, and medical device manufacturers. In the second half of 2022, more records were exposed due to breaches at business associates (48%) than actual healthcare providers (47%).
- Attacks against EMR systems, which were non-existent in past years, spiked to 7% in the first half of 2022 and 4% in the second half of 2022. For the full year 2022, EMR-related breaches accounted for 6 million individual records exposed.
Critical Insight focuses on organizations that deliver critical services, including hospitals, local governments, utilities, school systems, and more. The company specializes in providing end-to-end support to those with limited security teams or budgets to handle threats proactively.
