Submitted Successfully!
To reward your contribution, here is a gift for you: A free trial for our video production service.
Thank you for your contribution! You can also upload a video entry or images related to this topic.
Version Summary Created by Modification Content Size Created at Operation
1 handwiki -- 1140 2022-11-25 01:34:28

Video Upload Options

Do you have a full video?


Are you sure to Delete?
If you have any further questions, please contact Encyclopedia Editorial Office.
HandWiki. Medical Data Breach. Encyclopedia. Available online: (accessed on 13 June 2024).
HandWiki. Medical Data Breach. Encyclopedia. Available at: Accessed June 13, 2024.
HandWiki. "Medical Data Breach" Encyclopedia, (accessed June 13, 2024).
HandWiki. (2022, November 25). Medical Data Breach. In Encyclopedia.
HandWiki. "Medical Data Breach." Encyclopedia. Web. 25 November, 2022.
Medical Data Breach

Medical data, including patients' identity information, health status, disease diagnosis and treatment, and biogenetic information, not only involve patients' privacy but also have a special sensitivity and important value, which may bring physical and mental distress and property loss to patients and even negatively affect social stability and national security once leaked. However, the development and application of medical AI must rely on a large amount of medical data for algorithm training, and the larger and more diverse the amount of data, the more accurate the results of its analysis and prediction will be. However, the application of big data technologies such as data collection, analysis and processing, cloud storage, and information sharing has increased the risk of data leakage. In the United States, the rate of such breaches has increased over time, with 176 million records breached by the end of 2017. There have been 245 data breaches of 10,000 or more records, 68 breaches of the healthcare data of 100,000 or more individuals, 25 breaches that affected more than half a million individuals, and 10 breaches of the personal and protected health information of more than 1 million individuals.

social stability medical data health information

1. Black Market for Health Data

In February 2015 an NPR report claimed that organized crime networks had ways of selling health data in the black market.[1]

In 2015 a Beazley Group employee estimated that medical records could sell on the black market for US$40-50.[2]

Crime is the primary cause of medical data breaches.[3]

2. How Data Is Lost

Theft, data loss, hacking, and unauthorized account access are ways in which medical data breaches happen.[4] Among reported breaches of medical information in the United States networked information systems accounted for the largest number of records breached.[5] There is a large number of data breaches happening in the US health care system,[6] among business associates of the health care providers that continuously gain access to patients' data.[7]

3. List of Data Breaches

  • In May 2021, the Health Service Executive in the Republic of Ireland was the victim of a cyberattack involving ransomware, in the Health Service Executive cyberattack, with admission records and test results present in a sample of the data reviewed by the Financial Times .[8]
  • In October 2018, the Centers for Medicare and Medicaid Services in the US reported that around 75,000 individual records had been affected by a data breach that took place through the ACA Agent and Broker Portal.[9]
  • In 2018, Social Indicators Research published the scientific evidence of 173,398,820 (over 173 million) individuals affected in USA from October 2008 (when the data were collected) to September 2017 (when the statistical analysis took place).[10]
  • In 2015, Anthem Inc. lost data for 37 million people in the Anthem medical data breach
  • In 2014 4.5 million people using Complete Health Systems had their data stolen[11]
  • In 2013-14 1 million people using Montana Department of Public Health and Human Services had their data stolen[11]
  • In 2013 4 million people using Advocate Health and Hospitals Corporation had their data stolen[11]
  • In 2011 4.9 million users of Tricare services had their data stolen due to an employee error by Science Applications International Corporation[11]
  • In 2011 1.9 million people using Health Net had their data stolen[11]
  • In 2011 1 million people using Nemours Foundation had their data stolen[11]
  • In 2010 6800 people using New York-Presbyterian Hospital and Columbia University Medical Center had their data breached. In response, those organizations agreed to pay the United States Department of Health and Human Services a US$4.8 million dollar fine.[12]
  • In 2009 1 million people using BlueCross BlueShield of Tennessee had their data stolen[11]

4. Regulation

In the United States, the Health Insurance Portability and Accountability Act and Health Information Technology for Economic and Clinical Health Act require companies to report data breaches to affected individuals and the federal government.[13]

  • Health Information Privacy Health Insurance Portability and Accountability Act of 1996 (HIPAA). - 45 CFR Parts 160 and 164, Standards for Privacy of Individually Identifiable Health Information and Security Standards for the Protection of Electronic Protected Health Information. HIPAA includes provisions designed to save health care businesses money by encouraging electronic transactions, as well as regulations to protect the security and confidentiality of patient information. The Privacy Rule became effective April 14, 2001, and most covered entities (health plans, health care clearinghouses, and health care providers that conduct certain financial and administrative transactions electronically) had until April 2003 to comply. This security provision became effective April 21, 2003. The Health Insurance Portability and Accountability Act (HIPAA) is the baseline set of federal regulations governing medical information. It does three things: i. i. i.Establish a structure for how personal health information is disclosed and establish the rights of individuals with respect to health information; ii.Specify security standards for the retention and transmission of electronic patient information; iii.Need a common format and data structure for the electronic exchange of health information.
  • California-Specific Laws California’s medical privacy laws, primarily the Confidentiality of Medical Information Act (CMIA), the data breach sections of the Civil Code, and sections of the Health and Safety Code, provide HIPAA-like protections although the terminology is different. HIPAA establishes a federal "minimum standard" that applies where there are gaps in California law, and HIPAA also specifies that stricter state laws will override or supersede HIPAA. California's health care privacy laws apply to providers who provide personal health records (PHR), while HIPAA only applies when the provider providing the PHR is a business associate of a covered entity. Federal law does not grant individuals the right to file a lawsuit in the event of a data breach (only the Attorney General can file a lawsuit), but California law does.This means that California law sets a higher standard for medical privacy, and that individuals in California enjoy stronger legal protections and more ways to hold entities that violate their medical privacy accountable.
  • In the UK, the legal framework for how patient data is cared for and processed is the Data Protection Act 2018 (DPA), which incorporates the EU General Data Protection Regulation (GDPR) into law, and the common law duty of confidentiality (CLDC). The data protection legislation requires that the collection and processing of personal data be fair, lawful and transparent. This means that the collection and processing of data as defined by data protection legislation must always have a valid lawful basis and must also meet the requirements of the CLDC.
  • In the China, Article 18 of the "National Health Care Big Data Standards, Security and Services Management Measures (for Trial Implementation)" (National Health Planning and Development (2018) No. 23) promulgated by the National Health Care Commission in 2018 states, "The responsible unit shall adopt measures such as data classification, important data backup, and encryption authentication to guarantee the security of health care big data." However, the scope and definition of important data are not covered. Although the "Information Security Technology-Healthcare Data Security Guide" (the "Guide") issued by the National Standardization Committee also proposes that important data should be evaluated and approved in accordance with the regulations, there is likewise no definition of the connotation and definition of important data.


  1. Shahani, Aarti (13 February 2015). "The Black Market For Stolen Health Care Data : All Tech Considered : NPR". Retrieved 17 February 2015. 
  2. Abelson, Reed; Goldstein, Matthew (5 February 2015). "Anthem Hacking Points to Security Vulnerability of Health Care Industry". The New York Times (New York). ISSN 0362-4331. Retrieved 17 February 2015. 
  3. Richards, Robbie (16 November 2015). "Healthcare data breaches present a $6 billion threat". Retrieved 16 November 2015. 
  4. Millman, Jason (19 August 2014). "Health care data breaches have hit 30M patients and counting". The Washington Post (Washington DC: WPC). ISSN 0190-8286. Retrieved 17 February 2015. 
  5. McCoy, Thomas H.; Perlis, Roy H. (September 25, 2018). "Temporal Trends and Characteristics of Reportable Health Data Breaches, 2010-2017". JAMA 320 (12): 1282–1284. doi:10.1001/jama.2018.9222. ISSN 1538-3598. PMID 30264106.
  6. "HIPAA Compliance Checklist" (in en-US). 
  7. YARAGHI, NIAM; GOPAL, RAM D. (March 2018). "The Role of HIPAA Omnibus Rules in Reducing the Frequency of Medical Data Breaches: Insights From an Empirical Study". The Milbank Quarterly 96 (1): 144–166. doi:10.1111/1468-0009.12314. ISSN 0887-378X. PMID 29504206.
  8. Noonan, Laura; Shotter, James. "Irish patients’ data stolen by hackers appears online". 
  9. "CMS Reports Data Breach in ACA Agent and Broker Portal". 
  10. Koczkodaj, Waldemar W.; Mazurek, Mirosław; Strzałka, Dominik; Wolny-Dominiak, Alicja; Woodbury-Smith, Marc (2018). "Electronic Health Record Breaches as Social Indicators". Social Indicators Research 141 (2): 861–871. doi:10.1007/s11205-018-1837-z.
  11. Fischer, Kristen (28 September 2014). "The 7 Biggest Health Data Breaches in the US (So Far)". Retrieved 17 February 2015. 
  12. "Columbia Medical Center, Hospital To Pay $4.8M Fine for Data Breach". California HealthCare Foundation. 8 May 2014. Retrieved 17 February 2015. 
  13. Office of Civil Rights (26 July 2013). "Breach Notification Rule". 
Subjects: Others
Contributor MDPI registered users' name will be linked to their SciProfiles pages. To register with us, please refer to :
View Times: 252
Entry Collection: HandWiki
Revision: 1 time (View History)
Update Date: 25 Nov 2022
Video Production Service