It's a turbulent time for the healthcare industry: patient data is under siege and hospitals are big targets for cyberattacks—according to the Sixth Annual Benchmark Study on Privacy & Security of Healthcare Data, conducted by Ponemon Institute.

For the second year in a row, the study reveals that criminal attacks are the leading cause of data breaches in healthcare—up five percent to 50 percent this year.

Mistakes—unintentional employee actions, third-party snafus, and stolen computer devices—are cited as the root cause of the other half of data breaches. The findings indicate that many healthcare organizations and their third parties (business associates or BAs) are negligent in the handling of sensitive patient information. They also lack the budget, people resources, and expertise to manage data breaches caused by employee negligence and evolving cyber threats, including the newest threat cited for 2016: ransomware. 

Data breaches in healthcare are costing the industry $6.2 billion, and remain consistently high in terms of volume, frequency, impact, and cost—and have yet to decline since 2010—despite a slight increase in awareness and spending on security technology. While recent large healthcare data breaches have heightened the industry's awareness of the growing threats to patient data and have led to an improvement in security practices and policy implementation, respondents say that not enough is being done to curtail or minimize the risks. Nearly half of healthcare organizations, and more than half of BAs, have little or no confidence that they can detect all patient data loss or theft.

"In the last six years of conducting this study, it's clear that efforts to safeguard patient data are not improving. More healthcare organizations are experiencing data breaches now than six years ago," said Dr. Larry Ponemon, chairman and founder, Ponemon Institute. "Negligence—sloppy employee mistakes and unsecured devices—was a noted problem in the first years of this research and it continues. New cyber threats, such as ransomware, are exacerbating the problem."

Other findings of the research include: 

Data breaches in healthcare remain consistently high in terms of volume, frequency, impact, and cost. Healthcare organizations are experiencing a greater volume and frequency of data breaches; suffering multiple data breaches each. Eighty-nine percent of healthcare organizations and 60 percent of BAs experienced data breaches over the past two years. Seventy-nine percent of healthcare organizations experienced multiple data breaches (two or more) in the past two years—up 20 percent since 2010. More than one-third, or 34 percent, of healthcare organizations experienced two to five breaches. Nearly half of healthcare organizations, or 45 percent, had more than five breaches. Medical records are the most commonly exposed data, followed by billing and insurance records, and payment details. While the majority of breaches are small (less than 500 records) and are not reported to the U.S. Department of Health and Human Services (HHS) and the media, the financial impact is significant. The total economic impact of data breaches is $6.2 billion to the healthcare industry.

Newest cyber threat for 2016: ransomware. Criminal attacks are up in 2016 and are, once again, the leading cause of data breach among healthcare organizations, causing half of all data breaches and causing 41 percent of data breaches among BAs. Mistakes cause the other half of data breaches in healthcare. Based on the research, mistakes are classified as third-party snafus, stolen computing devices, and unintentional employee actions. The most concerning cyber threats among the healthcare industry are ransomware, malware, and DoS attacks. DoS attacks have been around a long time but continue to be prevalent. Ransomware is the newest cyber threat and concern for 2016. The study found that other top concerns to patient data are employee negligence, mobile device insecurity, use of cloud services, malicious insiders, and a growing concern about mobile apps (eHealth)—up from six percent in 2015 to 19 percent this year.

Healthcare industry is more vulnerable to data breach than other industries. Healthcare organizations believe they are more vulnerable to data breaches than other industries. Healthcare organizations have massive amounts of valuable data and often lack a strong security infrastructure and sense of accountability. Additionally, there are lots of "data touch" points, including multiple employees and third parties. The findings indicate that employees at healthcare organizations and their BAs are negligent in the handling of patient information and are not vigilant in protecting that information. Six years after the initial study, healthcare organizations are still stymied by the lack of resources and are not investing in technologies to mitigate a data breach. In fact, 59 percent of healthcare organizations and 60 percent of BAs don't think their organization's security budget is sufficient to curtail or minimize data breaches. The findings also reveal that BAs and healthcare organizations point their fingers at each other. Healthcare organizations say that third parties and partners are not doing enough, and BAs say that healthcare organizations are not investing in technology and employees are negligent.

Patients are suffering the effects of data breaches; increased awareness of medical identity theft cases. The research indicates that more healthcare organizations and BAs are aware of medical identity theft cases that have occurred internally since last year's study. Thirty-eight percent of healthcare organizations and 26 percent of BAs are aware of medical identity theft cases affecting their own patients and customers. Healthcare organizations and BAs both agree that patients suffer an increased risk of medical identity theft and financial identity theft if their records are exposed. Despite the known risks, 64 percent of healthcare organizations and 67 percent of BAs don't offer any protection services for victims whose information has been breached. Fifty-eight percent of healthcare organizations and 67 percent of BAs do not have a process in place to correct errors in victims' medical records. Errors in medical records can be detrimental to a patient, putting the patient at risk. Such errors can leave a patient vulnerable to receiving the wrong medical treatment or obtaining the wrong medications. If an identity thief uses a patient's name or health insurance number in order to receive medical care, the patient's health history and record will get mixed with the thief's, potentially causing harm to the patient.

The study is at  http://www2.idexpertscorp.com/ponemon2016