Each month, we review healthcare breaches to determine the leading cause and how the incidents could have been prevented. We do so by examining the Office for Civil Rights (OCR) online breach portal. The OCR publicly posts healthcare breaches that affected 500 or more patients to ensure that all affected patients know their information could have been potentially compromised. In January 2022, there were 50 large-scale breaches reported involving 2,304,607 patients.

January 2022 Healthcare Breaches

Most January 2022 healthcare breaches affected healthcare providers, with 31 incidents. These 31 incidents compromised the protected health information (PHI) of 1,896,191, representing 82.28% of patients affected by January incidents. Business associates reported an additional 13 incidents. Business associate incidents affected 382,585 patients, representing 16.6% of patients affected. Six health plans also reported incidents affecting 25,831 patients and representing 1.12% of affected patients. In January, two types of incidents caused the majority of breaches – hacking incidents and unauthorized access or disclosure of PHI. There was also one incident of PHI theft reported that affected 21,601 patients.

January 2022 Healthcare Breaches and Hacking

It is no surprise that hacking was the leading cause behind January 2022 healthcare breaches. There were 38 hacking incidents reported in January that affected 2,202,550 patients. These 38 incidents represented 95.57% of patients affected by January incidents.

Entities affected by hacking:

  • 24 healthcare providers, 1,811,264 patients, 82.23% of patients affected by hacking
  • 12 business associates, 255,286 patients, 11.59% of patients affected by hacking
  • 2 health plans, 136,000 patients, 6.17% of patients affected by hacking

Types of hacking incidents:

  • 11 email hacks, 1,436,220 patients, 65.21% of patients affected by hacking
  • 25 network server hacks, 755,941 patients, 34.32% of patients affected by hacking
  • 2 “other” hacks, 10,389 patients, 0.47% of patients affected by hacking

How to Prevent Hacking Incidents

As hacking incidents have become the leading cause behind healthcare breaches for several years, it is crucial to minimize your risk of being targeted.

Security Risk Assessments and Remediation

Security risk assessments (SRAs) are vital for security and compliance. The purpose of an SRA is to identify weaknesses and vulnerabilities in your security practices so that you can prepare yourself against potential threats. Once SRAs have been conducted, it is important to create remediation plans to address any identified deficiencies.

Employee Cybersecurity Training

A large portion of hacking incidents stem from phishing emails. This is why employee cybersecurity training is essential to your organization’s overall security posture. Employees should be trained on recognizing phishing attempts, and what to do if they suspect an incident has occurred.

Let’s Simplify Compliance

Protect your business from breaches by becoming HIPAA compliant today!

Learn More!
HIPAA Seal of Compliance