August 2022 Healthcare Breach Report

Each month, we review healthcare breaches to determine the leading cause and how the incidents could have been prevented. We do so by examining the Office for Civil Rights (OCR) online breach portal. The OCR publicly posts healthcare breaches that affected 500 or more individuals to ensure that all affected patients know their information could have been potentially compromised.

Business associates had another bad month in August, with more than three times the number of patient records breached than covered entities. Business associates reported 2,817,598 records breached in August, while covered entities tallied 898,177 breached files. Data breaches affected 3,715,755 records containing protected health information (PHI) during August. 

In August 2022, there were 48 large-scale breaches reported, 34 of which affected healthcare providers. These 34 incidents compromised the PHI of 751,869 individuals, representing 20.2% of patients affected by the August incidents. 

Business associates reported nine additional incidents that affected 2,817,598 patients, representing 75.8% of patients affected. 

Five health plans also reported incidents affecting 146,308 patients and representing almost 4% of affected patients. 

In August, 34 breaches resulted from hacking incidents. There were ten breaches caused by unauthorized access or disclosure of PHI, two incidents involving theft, and two resulting from loss of PHI.

Protect Your Business, Protect Patients

HIPAA compliance helps to prevent healthcare breaches.

Become HIPAA Compliant

August 2022 Healthcare Breaches and Hacking

Cybercriminals are still busy as hacking continued its streak at the top of the list of causes of healthcare breaches in August 2022. The 34 hacking incidents reported in August affected the PHI of 2,311,875 patients. These 47 incidents represented 97.5% of all reported records breached during the month.

Entities affected by hacking:

  • 25 healthcare providers, 736,711 patients, 31.9% of patients affected by hacking
  • 5 business associates, 1,429,038 patients, 61.8% of patients affected by hacking
  • 4 health plans, 145,604 patients, 6.3% of patients affected by hacking

Types of hacking incidents:

  • 26 network server hacks, 2,129,880 patients, 92.1% of patients affected by hacking
  • 7 email hacks, 178,995 patients, 7.8% of patients affected by hacking
  • 1 electronic medical records systems/network server hack, 3,000 patients, 0.1% of patients affected by hacking

How to Prevent Hacking Incidents

As hacking incidents have become the leading cause behind healthcare breaches for several years, minimizing your risk of being targeted is crucial.

Security Risk Assessments and Remediation

Security risk assessments (SRAs) are vital for security and compliance. An SRA aims to identify weaknesses and vulnerabilities in your security practices to prepare yourself against potential threats. Once SRAs have been conducted, it is essential to create remediation plans to address any identified deficiencies.

Employee Cybersecurity Training

A significant portion of hacking incidents results from phishing emails. This is why employee cybersecurity training is essential to your organization’s overall security posture. Employees should be trained on recognizing phishing attempts and what to do if they suspect an incident has occurred.