Upload File

managing hipaa data breaches...data breaches by the numbers $6.5 million – average cost of a data...

  • Home
  • Documents
  • Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost
31
© Shipman & Goodwin LLP 2016. All rights reserved. William J. Roberts, Esq. June 15, 2016 Managing HIPAA Data Breaches

Upload: others

Post on 27-Jul-2020

0 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

©Shipman&GoodwinLLP2016.Allrightsreserved.

WilliamJ.Roberts,Esq.

June15,2016

ManagingHIPAADataBreaches

Page 2: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

Agenda•  WhataretheRisksofaBreach?

•  IdenPfyingInternalThreats•  IdenPfyingExternalThreats•  RespondingtoaDataBreach

2

Page 3: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

DataBreachesbytheNumbers$6.5million–averagecostofadatabreach

11%-increaseincostbetween2014and2015

$217–averagecostperlostorstolenrecord

112million–numberofindividuals(U.S.only)affectedbyahealthcaredatabreachin2015

432million–numberofhackedaccounts(U.S.only)in2014

Sources:(1)2015CostofDataBreachStudy:UnitedStates,PonemonInsPtuteResearch;(2)DataBreachesInHealthcareTotaledOver112MillionRecordsIn2015,Forbes,12/31/2015

3

Page 4: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

DataBreaches

•  BreachesareincreasinginsophisPcaPon,frequencyandseverity

•  HealthcareisaprimarytargetofbreachacPvityandissubjecttoheightenedgovernmentscruPnyandenforcement

•  Threatscanbecategorizedintwoways:u  External

u  Internal

4

Page 5: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

IdenPfyingInternalThreats

•  Insiderthreatsaretwofold:u  “MaliciousInsider”–Wishtodoharmtocompany

Ø  Canbeemployeethegforpersonalorbusinessgain

Ø  Terminatedemployeestakingdata

Ø  Accessingdataoutsidescopeofemployment

Ø  Employeespurposelymisusingdata

5

Page 6: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

IdenPfyingInternalThreats•  Insiderthreatsaretwofold:

u  “Careless”or“Negligent”InsiderØ  Noillwill,butthroughcarelessness,negligenceorlackoftraining,createsopeningsfordataloss

Ø  Study:“TheHumanFactorinDataProtecPon”(hhp://www.ponemon.org/local/upload/file/The_Human_Factor_in_data_ProtecPon_WP_FINAL.pdf)

Ø  EmployeesarelikelygreatestthreattoPHI

Ø  Includeslostfiles,laptops,mobiledevices

6

Page 7: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

IdenPfyingExternalThreats

•  Externalthreatstaketwoforms–u  AnahackonyourinformaPonsystemsorthegofphysicalfiles,or

u  AnahempttotrickanemployeetodivulgesensiPveinformaPon

7

Page 8: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

Cybersecurity–TheStats

Averageannualnumberofcybersecurityincidents:80to90million

Increaseincybersecurityincidentsfrom2014–2015:38%

Projectedglobalcostofcyberahacksin2019:2.1trillionUSdollars

hhp://expandedramblings.com/index.php/cybersecurity-staPsPcs/Source:

8

Page 9: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

It’sPhishingSeason!•  “Phishing”isanahempttouseemailtotrickarecipientintodisclosingpersonalinformaPon,suchasfinancialaccountinformaPon

•  WeareseeingincreasedsophisPcaPonandvolumeofahempts

hhps://blog.cyveillance.com/cyveillance-phishing-report-top-targets-june-22-2015/

9

Page 10: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

Masquerading•  “Masquerading”isascaminwhichtheperpetratorassumestheidenPtyofaknown,trustedcolleaguetotrickthecolleagueintotakingsomeacPon,ogensendingemployeeorfinancialdataorwiringfunds

10

Page 11: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

ARansomforYourData•  AransomwareahackisoneinwhichaperpetratorassumescontrolofyourdataandwillnotreleaseitunPlpaymentismade(orthreatenstofurtherdiscloseitunlesspaymentismade)

•  Paymentisogenrequestedinbitcoin

11

Page 12: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

You’veBeenHacked•  Hackingahemptsare

increasinglycommoninallindustrysectors

•  Healthcare,educaPon,government,retailandfinancearethemostpopulartargets

•  SmallenPPesarejustaslikely(ifnotmorelikely)tobetargetsaslarge,well-knowncorporaPons

Source:IndianapolisStar,12/15/14

12

Page 13: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

RespondingtoaDataBreachDiscovery

InvesPgaPon

NoPficaPon(s)MiPgaPon

DamageControl

13

Page 14: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

Discovery•  ReporPngStructure:

u  IncidentnoPficaPonpolicyu  Employee/stafftrainingu  Cultureoftransparency,notfearu  Considermockbreaches

•  Needtohaveabreachresponseplaninplacetoguideresponse.Consider:u  TheRightTeam:IT,compliance,HR,paPent/publicrelaPons,legalcounsel

u  Back-upsforeachkey,responsibleindividual(e.g.leave,vacaPon)

14

Page 15: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

InvesPgaPon

•  ThecoveredenPtymustinvesPgatethereportofthebreachwithoutdelayu  Ahorney-clientprivilegeisvitaltoprotectyourinterests

u  Haveexternalresourceslined-upaheadofPme:PR,forensicIT,lawenforcementcontacts,externalcounsel

u  OnlyinvolvethenecessaryparPes–confidenPalityisimportant

15

Page 16: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

NoPficaPontoIndividuals•  Rule:CoveredenPPesmustnoPfyaffectedindividualsfollowingthe

discoveryofabreachofunsecuredprotectedhealthinformaPonu  NoPcemustbewrihenandsentbyfirst-classmail,oralternaPvely,by

e-mailiftheaffectedindividualhasagreedtoreceivesuchnoPceselectronically

u  NoPcemustbeprovidedwithoutunreasonabledelayandinnocaselaterthan60daysfollowingdiscovery

u  NoPcemustinclude,totheextentpossible,abriefdescripPonofthebreach,adescripPonofthetypesofinformaPonthatwereinvolvedinthebreach,thestepsaffectedindividualsshouldtaketoprotectthemselvesfrompotenPalharm,abriefdescripPonofwhatthecoveredenPtyisdoingtoinvesPgatethebreach,miPgatetheharm,andpreventfurtherbreaches,aswellascontactinformaPon

16

Page 17: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

NoPficaPontoIndividuals•  Consider:

u  DevelopcommunicaPonlines–tollfreenumber,email,postaladdress

u  Whowillrespondtoinquiries?Internalresourcessufficientorcallcenterneeded?

u  FAQsu  Languageanddisabilityconcerns?u  Minors?u  Decedents?u  CanyouhandlethecommunicaPonsin-house?

17

Page 18: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

SubsPtuteNoPce•  Rule:Insufficientorout-of-datecontactinformaPonfor:u  10ormoreindividuals-thecoveredenPtymustprovidesubsPtutenoPcebyeitherposPngthenoPceonthehomepageofitswebsiteforatleast90daysorbyprovidingthenoPceinmajorprintorbroadcastmediawheretheaffectedindividualslikelyreside

Ø  mustincludeatoll-freephonenumberthatremainsacPveforatleast90dayswhereindividualscanlearniftheirinformaPonwasinvolvedinthebreach

u  Fewerthan10individuals-thecoveredenPtymayprovidesubsPtutenoPcebyanalternaPveformofwrihennoPce,bytelephone,orothermeans

18

Page 19: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

NoPficaPontotheMedia•  Rule:CoveredenPPesthatexperienceabreachaffecPngmorethan500

residentsofastateorjurisdicPonare,inaddiPontonoPfyingtheaffectedindividuals,requiredtoprovidenoPcetoprominentmediaoutlets

u  Ogenintheformofapressrelease

u  Withoutunreasonabledelayandinnocaselaterthan60daysfollowingdiscovery

u  MustincludethesameinformaPonrequiredfortheindividualnoPce

•  Consider:u  PRprofessionalassistance

u  Mediatalkingpoints

u  Mediapointperson–whospeaksforyourorganizaPon(andwhodoesnot)

u  Controllingthemessage/coordinaPngwithemployees

u  Becognizantofmedialeaks/stealthinquiries

19

Page 20: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

NoPficaPontoHHS•  Rule:CoveredenPPesmustnoPfyHHSbysubmisngabreachreportformonlineu  500ormoreindividuals,coveredenPPesmustnoPfyHHSwithoutunreasonabledelayandinnocaselaterthan60daysfollowingabreach

u  Fewerthan500individuals,thecoveredenPtymaynoPfyHHSofsuchbreachesonanannualbasis,duetoHHSnolaterthan60daysagertheendofthecalendaryearinwhichthebreachesarediscovered

•  Consider:u  Accuracyisvitalu  Summarystatementmayhavesignificantconsequences

20

Page 21: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

OtherNoPficaPonObligaPons?•  Dependinguponyoursector,contractualarrangementsorlocaPon,considerthefollowingaddiPonalnoPficaPonsthatmaybenecessary:u  StateAhorneyGeneral(s)u  Stateregulatoryagencies(e.g.DepartmentsofHealth,InsuranceorConsumerProtecPon)

u  Businesspartners(e.g.HIEs,affiliates)u  DepartmentsofEducaPon(stateandfederal)u  PoliPcalstakeholders(esp.ifgovernmentalenPty)u  Funders(looktogrants,donors)u  Employees(e.g.email,IntranetposPng)

21

Page 22: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

ThoughtsonBABreaches

•  AtPmes,abreachiscausedbyoroccursatyourbusinessassociate.Whenplanningforandrespondingtosuchabreach,consider:u  BAAreporPng,cooperaPon,miPgaPonandliabilityissues–istheBAAyourfriendorfoe?

u  WhoshouldnoPfy?

u  Controlofmessaging

22

Page 23: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

MiPgaPon•  Rule:AcoveredenPtymusttakereasonablestepstomiPgateharmtoindividualscausedbythebreachu  HIPAAislightonspecificsbutstatelawsarenowmandaPngcertainmeasures

•  Consider:u  WhatinformaPoncanyouprovidetoaffectedparPes?

u  Creditmonitoring–when?Requiredbylaw?

u  Creditcounseling,idenPtythegrecoveryservices

u  IdenPtytheginsurance

23

Page 24: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

DamageControl

•  Adatabreachmayinflictsignificantfinancial,operaPonalandreputaPonalcostsonacompany.Employeemoraleandconfidencemayalsosuffer.Developaplanfor:u  RespondingtoquesPonsandconcernsfromcurrentandformeremployees,paPentsorcustomers

u  Handlinginquiriesfromrelevantbusinesspartners

u  Managingthecompany’sreputaPoninthebusinessandconsumercommuniPes

24

Page 25: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

LegalRisks

•  LawsuitsCanandWillComefromSixSources:u  Consumers

u  Insurers

u  FinancialInsPtuPons

u  Shareholders

u  Employees

u  Government

25

Page 26: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

GovernmentEnforcement

•  AHIPAAbreachmayresultinenforcementacPonsfromstateahorneygeneralsandtheHHSOfficeforCivilRights(OCR)

•  Insomeinstances,otherenforcementagencies,includingconsumerprotecPon,health,educaPonorinsurancedepartments,mayhavejurisdicPonu  Key–aHIPAAbreachogenviolatesotherstateandfederallaws,meaningmoreopportuniPesforenforcement

26

Page 27: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

LegalRisksandGovernmentEnforcement

•  Needtoprepareforthefollowingfrom“DayOne”:u  OCRinvesPgaPonandenforcementacPonu  AhorneyGeneralinvesPgaPonandenforcementacPon

u  LawsuitsfrompaPents,customers,businesspartners

•  Everythingyoudofrompreparingforthebreachtoyourresponsetoitisinprepara7onfortheseenforcementac7onsandlawsuits

27

Page 28: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

PenalPes•  Recentchangestothelawhavesignificantlyincreasedthe

penalPesforviolaPngHIPAA:

u  FourPersofcivilmonetarypenalPesrangingfrom$100/perviolaPonto$1.5million/perviolaPon

u  CriminalpenalPes:upto$250,000infinesandupto10yearsinprison

•  BoththecoveredenPtyandindividualemployeescanbepenalizedforviolaPngHIPAA

•  BreachesmayalsoresultincostlyconsentordersorcorrecPveacPonplans,lawsuitsandaddiPonalpenalPesstateenforcementacPons

28

Page 29: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

LearnfromOthers

•  In2014,NewYork-PresbyterianHospitalandColumbiaUniversityenteredintosehlementfor$4.8MforfailingtosecurepaPentinfo

•  Gov’tconcludedcompanies:Ø  Lackedtechnicalsafeguards

Ø  Failedtoconductaccurateriskanalyses

Ø  FailedtodevelopadequateriskmanagementplanstoaddresspotenPalsecuritythreats

29

Page 30: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

Ques8ons+ContactInforma8on

WilliamJ.Roberts,ChairPrivacy+DataProtecPon

Tel:[email protected] Source:TheNewYorker,Sept.8,2015

“Bad news, captain. The ship’s computer has been sharing all our personal data with the Romulans.”

30

Page 31: Managing HIPAA Data Breaches...Data Breaches by the Numbers $6.5 million – average cost of a data breach 11% - increase in cost between 2014 and 2015 $217 – average cost per lost

© 2007-2016 31

855-85-HIPAA www.compliancygroup.com

Need Help With HIPAA Compliance?

§  The Guard •  Total Compliance Solution •  Simple •  Cost-effective •  Compliance with Confidence

§  Support - We work with you •  Compliance Coaching •  HIPAA Hotline •  Education •  Culture of Compliance

§  Contact Us •  855 85 HIPAA (855-854-4722) •  www.CompliancyGroup.com

Incident Management

Audits SRA (Security Risk

Assessment), Administrative, Privacy

Remediation Plans

Policies, Procedures & Training

Business Associate

Management

Document Version

Employee Attestation &

Tracking


Cyber Security Breaches Survey 2019 - gov.uk...such negative outcomes from breaches, the average cost was £9,470 in 2019. The quantitative survey highlights that the costs of cyber

True Cost of Data Breaches

The Cost Of Inactivity - Malware breaches-infographic

The Internet’s Underground Economy...The Problem 1. Fully 61% of U.S. computers are infected with malware. 2. Data breaches cost companies an average of $197 per record in 2007,

Marginal Cost Versus Average Cost Pricing with Climatic Shocks in Senegal…ageconsearch.umn.edu/bitstream/12028/1/wp060144.pdf ·  · 2017-04-01Marginal Cost Versus Average Cost

GOV UK · REPORTING BREACH £1.15m AVERAGE COST OF SECURITY BREACH Source: 2014 Information Security Breaches Suwey sponsored by the Department for Business, Innovation and Skills

Weighted Average Cost of Capital (2003)

Data Destruction and The Impact on Recycling. Data Breaches In 2012, over 26M records from 617 data breaches were made public Average costs: –$194 per

gastateparks.org · Average operating cost per visitor (FY 2010) $1.69 Average earned revenue per visitor (FY 2010) $0.61 Average cost recovery[1] (FY 2008 – 2010) 30% Target cost

Cost HSPM J712. Cost concepts Opportunity cost Total cost Fixed cost Variable cost Average cost Marginal cost

YOUHAVEBEENHACKED – NOWWHAT?€¦ · have significant breaches each year and one quarter of smaller companies are breached. The cost of respond-ing to each of these breaches is

What Year Was It? By: Kristen Leisse. COST OF LIVING Average Cost of New House $49,300.00 Average Cost of New House $49,300.00 Average Income per year

DAMAGE CONTROL: THE COST OF SECURITY BREACHES IT

MARGINAL OPPORTUNITY COST VS. AVERAGE COST PRICING OFWATERSERVICE

COST THEORY AND ESTIMATION · Total Variable Cost = TVC TC = TFC + TVC 5/5/17. 13 AVERAGE COSTS Average total cost (also called average cost) equals total cost per unit of output

WHITEPAPER - SharkGate · the cost of data breaches to $2.1 trillion globally by 2019, increasing to almost four times the estimated cost of breaches in 2015”. 9 The continued increase

Detecting and Preventing Information Security Breaches · 2.3 Cost of a Data Breaches The cost associated with a data breach has escalated due to the increase of incidents as compared

Raipur Region - WordPress.com · Raipur Region STYDY MATERIAL CLASS-XII ... total fixed cost, total variable cost; Average fixed cost, average variable cost and marginal cost-meaning

Trailing average cost of debt - Queensland Competition Authority€¦ · The trailing average cost of debt is an historical average of the cost of debt. The historical period corresponds

Cost of Information Systems Security Breaches · 2016. 4. 4. · Average Cost of a Security Breach Average Total Cost of a data breach 2014: $3.52 Million 2014: $3.52 Million Average

Appendix A ECON 201 Course Web Site Spring 2000 · TC - Total Cost = TFC + TVC AFC - Average Fixed Cost = AVC - Average Variable Cost = ATC - Average Total Cost = MC - Marginal Cost

More Connected, More at Risk - BKD · 2019-04-02 · Breaches Are Costing More & More Average total cost of a data breach $3.86 million Average cost per lost or stolen record $148

FSR TRAINING COURSEw3.ekof.bg.ac.rs/nastava/ekonomija_men_energetike/2012/03...MCe = Average cost = Total cost / q marginal cost(MC): additional cost of producing one more unit average

Weighted Average Cost of Capital

SECURE CUSTOMER DATA: ARE YOU AND YOUR CUSTOMERS AT … · 2.0 the real cost of data breaches to the retail sector 2.1 cost of reputation 3.0 data breaches in europe and the dach

Production and Cost - Launchpad · 2014. 4. 18. · Use graphs to show the relationship between short-run average fixed cost, average variable cost, average total cost, and marginal

Insurance Coverage for Data Breaches and Unauthorized ... · Data breaches are most expensive in the United States where the average per capita cost of a data breach was $233 in 2018,

The Cost Of Preventing Breaches Educause Nat Conf Denver Nov 09

Data Breaches and Sensitive Data Riskusdatavault.com/library/Data Breaches and Sensitive Data Risk.pdf · On average, 35 percent of an organization’s data is considered sensitive

Information Security – Changes in the Law, Cost, and Complexity of Responding to Breaches

Data Breach Readiness 2€¦ · Data breaches have become far more expensive to deal with. According to research from the Ponemon Institute, the average cost of dealing with a data

SECURITY BREACHES...In 2013, it is estimated that over 66% of all security breaches happened in the United States. The average total organizational cost, according to one survey, was

Chapter 8. Production and Cost Start Up: Street Cleaning ... · firm that produces airplanes, ... total cost, average variable cost, average fixed cost, average total cost, and marginal

IS T COST TO PRIVACY BREACHES AN EVENT STUDY1 THERE A COST TO PRIVACY BREACHES? AN EVENT STUDY1 Alessandro Acquisti Carnegie Mellon University [email protected] Allan Friedman

Data Breaches: What’s an In-House Lawyer to do? · REASON FOR BREACH (IN %) * Internal Bad Actor Accidental Disclosures Loss of Data Physical Theft-Average total cost of a data