February 2023 Healthcare Breach Report

Based on the current numbers, February 2023 was a good month for the good guys as only 5,419,467 records containing patients’ protected health information (PHI) were breached, continuing a two-month downward trend. Hacking/IT incidents remained the cause of the most significant amount of PHI breached in February 2023, with more than 5,396,973 records.

In February 2023, there were 41 large-scale breaches reported, 30 of which affected healthcare providers. These 30 incidents compromised the PHI of 4,620,291 individuals, representing 85.3% of patients affected by the February incidents. 

Business associates reported four incidents that affected 530,233 patients, representing 9.8% of patients affected. 

Four health plans also reported incidents affecting 268,943 patients, representing 4.9% of affected patients. 

Hacking/IT incidents were responsible for 31 breaches reported in February 2023. There were 8 breaches caused by unauthorized access or disclosure of PHI, one incident involving theft of PHI, and one incident involving improper disposal.

February 2023 Healthcare Breaches and Hacking

Hacking continued its streak at the top of the list of causes of healthcare breaches in February 2023. The 31 hacking incidents reported in February affected the PHI of 5,396,973 patients. These 31 incidents represented 99.6% of all documented records breached during the month.

Entities affected by hacking:

• 22 healthcare providers, 4,599,314 patients, 85.2% of patients affected by hacking
• 6 business associates, 529,247 patients, 9.8% of patients affected by hacking
• 3 health plans, 268,412 patients, 5% of patients affected by hacking

Types of hacking incidents:

• 22 hacks of network servers, 5,108,506 patients, 94.7% of patients affected by hacking
• 6 email hacks, 283,069 patients, 5.2% of patients affected by hacking
• 2 electronic medical records & other sources, 4,898 patients, 0.1% of patients affected by hacking
• 1 desktop computers & other causes, 500 patients, less than .01% of patients affected by hacking

How to Prevent Hacking Incidents

As hacking incidents have become the leading cause behind healthcare breaches for several years, minimizing your risk of being targeted is crucial.

Security Risk Assessments and Remediation

Security risk assessments (SRAs) are vital for security and compliance. An SRA aims to identify weaknesses and vulnerabilities in your security practices to prepare yourself against potential threats. Once SRAs have been conducted, it is essential to create remediation plans to address any identified deficiencies.

Employee Cybersecurity Training

A significant portion of hacking incidents results from phishing emails. Employee cybersecurity training is essential to your organization’s overall security posture. Employees should be trained on recognizing phishing attempts and what to do if they suspect an incident has occurred.

February 2023 Healthcare Breaches and Unauthorized Access or Disclosure

Incidents of unauthorized access or disclosures of PHI can occur in two ways – an authorized employee accesses PHI inappropriately, or an unauthorized party gains access to PHI. February 2023 recorded 8 incidents of unauthorized access or disclosure of PHI. These incidents affected 13,950 patients, representing 0.26% of the breached records reported in February.

Entities affected by unauthorized access or disclosure:

• 7 healthcare providers, 13,419 patients, 96.2% of patients affected by unauthorized access or disclosure 
• 1 health plan, 531 patients, 3.8% of patients affected by unauthorized access or disclosure 

Types of unauthorized access or disclosure:

• 1 electronic medical records incident, 8,834 patients, 63.3% of patients affected by unauthorized access or disclosure
• 2 network server and other incidents, 1,877 patients, 13.5% of patients affected by unauthorized access or disclosure
• 3 email incidents, 2,105 patients, 15.1% of patients affected by unauthorized access or disclosure
• 1 paper/film, 634 patients, 4.5% of patients affected by unauthorized access or disclosure
• 1 desktop computer, 500 patients, 3.6% of patients affected by unauthorized access or disclosure

How to Prevent Unauthorized Access or Disclosure

As we mentioned, there are two ways in which unauthorized access or disclosures occur – inappropriate employee access or unauthorized access by another entity.

Policies and Procedures and Employee Training

HIPAA policies and procedures are essential to HIPAA compliance as they guide employees on what is appropriate. HIPAA requires employee use and disclosure of PHI to be limited to the minimum necessary to perform their job functions. Your policies and procedures should dictate this, and employees should be trained on the policies and procedures to be aware of their obligations. 

User Authentication, Access Controls, and Audit Controls

To ensure adherence to the minimum necessary standard, you must implement user authentication, access controls, and audit controls. User authentication provides unique login credentials for each employee, while access controls enable administrators to designate different PHI access levels using those unique login credentials. Also, based on the implementation of unique login credentials, audit controls track access to data to ensure that PHI is accessed appropriately by each employee.

February 2023 Healthcare Breaches and Other Causes

In February 2023, one business associate reported the theft of a portable electronic device to OCR that affected 986 individuals, representing less than 0.1% of the breached records reported in February. One covered entity reported improper disposal of paper/film that affected 758 individuals, representing less than 0.1% of the breached records reported in February.