Why Healthcare Data Is a Premium Target
Stolen credit card numbers typically sell for one to two dollars on dark web marketplaces. Stolen medical records sell for significantly more, sometimes reaching hundreds of dollars per record. The reason is simple: medical records contain a dense concentration of information that enables multiple types of fraud.
A single medical record may include:
- Full legal name, date of birth, and Social Security Number
- Insurance policy numbers and group IDs
- Billing addresses and phone numbers
- Medical history, diagnoses, and prescription information
- Payment card details used for copays and balances
This combination supports identity theft, insurance fraud, prescription fraud, tax fraud, and targeted phishing campaigns. Unlike a credit card number that becomes worthless once canceled, the personal information in a medical record remains valid indefinitely.
The Scale of Healthcare Breaches
The U.S. Department of Health and Human Services maintains a public "Wall of Shame" listing healthcare breaches affecting 500 or more individuals. The trend line is alarming:
- Breach volume has increased year over year for more than a decade
- Individual records exposed annually regularly exceed tens of millions
- Ransomware attacks on hospitals have become a leading cause, with attackers encrypting systems and threatening to release patient data
- Third-party vendors including billing companies, cloud providers, and IT service firms account for a growing share of breaches
Notable healthcare breaches include Anthem (78.8 million records), Premera Blue Cross (11 million records), and numerous hospital systems that have been crippled by ransomware attacks.
What HIPAA Actually Requires
The Health Insurance Portability and Accountability Act establishes federal standards for protecting health information, but its requirements are often misunderstood.
The Privacy Rule
Covered entities (healthcare providers, health plans, and healthcare clearinghouses) and their business associates must:
- Limit use and disclosure of protected health information (PHI) to the minimum necessary
- Provide patients access to their own medical records
- Obtain written authorization before using PHI for marketing or selling it
- Train workforce members on privacy policies and procedures
The Security Rule
Applies specifically to electronic PHI and requires:
- Administrative safeguards including risk assessments, workforce training, and contingency planning
- Physical safeguards including facility access controls and workstation security
- Technical safeguards including access controls, audit logs, transmission encryption, and integrity controls
The Breach Notification Rule
When a breach of unsecured PHI occurs:
- Individuals must be notified within 60 days of discovery
- HHS must be notified within 60 days for breaches affecting 500 or more individuals
- Media must be notified for breaches affecting 500 or more residents of a state
- Smaller breaches (under 500 individuals) must be reported to HHS annually
What HIPAA Does Not Do
HIPAA is not a comprehensive data security law. Important limitations include:
- No private right of action. Individuals cannot sue organizations directly for HIPAA violations. Enforcement is handled by HHS Office for Civil Rights and state attorneys general.
- Limited scope. HIPAA only covers covered entities and their business associates. Health apps, fitness trackers, and direct-to-consumer genetic testing services may not be subject to HIPAA at all.
- Penalties vary widely. Fines range from a few thousand dollars for unknowing violations to millions for willful neglect, but enforcement has been inconsistent.
- No data minimization mandate. HIPAA's "minimum necessary" standard applies to disclosure, but there is no hard limit on how much data an organization can collect.
Your Rights After a Medical Data Breach
If you receive a breach notification from a healthcare provider or insurer, you have several rights and options:
Immediate Steps
- Read the notification carefully to understand what data was exposed
- Place a fraud alert on your credit files with all three bureaus
- Consider a credit freeze if Social Security Numbers were exposed
- Accept free credit monitoring if offered; it costs you nothing and provides an additional detection layer
- Change passwords on your patient portal and any accounts using the same credentials
File Complaints
- HHS Office for Civil Rights accepts HIPAA complaints online at hhs.gov/ocr
- Your state attorney general can investigate and take enforcement action
- State health departments may have additional oversight authority
Monitor for Medical Identity Fraud
Medical identity theft has unique consequences beyond financial fraud:
- Review your Explanation of Benefits (EOB) statements for procedures or prescriptions you did not receive
- Request your medical records and check for unfamiliar entries that could indicate someone used your insurance
- Monitor your insurance claims for services at unfamiliar facilities
- Check your prescription drug history for medications you were not prescribed
Incorrect medical records created by identity theft can lead to dangerous situations if a provider makes treatment decisions based on a fraudster's medical history mixed into your file.
Protecting Your Medical Data
- Use strong, unique passwords on patient portals and health apps
- Enable two-factor authentication on healthcare accounts when available
- Be cautious with health apps that are not subject to HIPAA protections
- Review privacy policies before sharing health data with non-covered entities
- Limit the information you share on intake forms to what is clinically necessary
Your health data deserves the same vigilance you apply to your financial accounts. Monitor your overall digital exposure using LeakedSource and take action when your information appears in breach databases.