Healthcare industry battles breaches.

• Position: INFO SECURITY

There was a 30% increase in the number of breaches on the Identity Theft Resource Center's 2013 breach list released earlier this year compared to 2012. And the highest percentage occurred in the healthcare industry: 44% compared to 34% for the business sector, which has topped the list since 2005.

One reason for the dramatic increase is the tougher reporting requirements of the final rule of the Health Insurance Portability and Accountability Act (HIPAA) that became effective in 2013. The U.S. Department of Health and Human Services (HHS) recently submitted its annual breach report to Congress for 2012. It showed that theft continues to be the leading cause of breaches of unsecured protected health information; the percentage increased to 52% in 2012 from 49% in 2011.

What happened in 2013? HHS is still compiling the data, but in the meantime, a 2014 benchmarking study of 505 healthcare organizations conducted by Ponemon Institute showed a slight decrease in the number of breaches reported in 2013.

The cost of data breaches to healthcare organizations continues to average about $2 million over a two-year period. Based on the experiences of the 2014 participants, Ponemon estimates the cost...