This is an interactive dashboard of healthcare breaches affecting 500 or more individuals. You have the ability to filter breaches by date and category (breach type)

Our team at Stern Security initially created this dashboard to provide trend data to HIPAA Risk Analysis engagements and the subsequent reports. In the beginning we would perform the grueling process of compiling healthcare breach data using Excel and this was very inefficient. We needed to find a better way to analyze all of the healthcare data breach information in order to investigate breach trends, provide recommendations and to visualize the data in our reports and presentations. So we decided to automate the number crunching and chart creation process. We found our dashboard so useful that we wanted to share it with the world and help bring more attention to the severity of healthcare breaches. We hope that it will help others with their security programs and help secure Protected Health Information (PHI). HealthcareBreaches.com was born.

You can use the "filter bar" on the left side of the screen.

If you click on either "Month" or "Year" the dashboard displays additional charts per your selection.

According to Health and Human Services, a "Business Associate" is "a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity." Some examples include a patient portal vendor, attorneys for a covered entity that may have access to PHI, or an medical transcriptionist provider. Basically, a "business associate" is a trusted 3rd party for the healthcare organization.

Hacking/IT Incident: Use a computer to gain unauthorized access to data in a system. Examples include server compromises, and malware infections.

Unauthorized Access/Disclosure: This is often a "catch all" category. At the most basic level it means that an unauthorized individual accessed information that they did not have authorization to view. Examples include healthcare employees viewing information that they do not have authorization, patient data exposed to the incorrect patient, identity theft by healthcare (covered entity) employee, email/fax sent to the wrong recipient, or an burglary occurs in an office and the thief may have seen patient records.

Theft: Physically obtaining access to protected health information. Examples include stolen laptops, stolen file cabinet, etc...

Improper Disposal: Insecure disposal of protected health information. Examples include putting healthcare records in the trash without shredding or donating/selling computers without erasing the data first.

Loss: Inadvertently losing protected health information. Examples include, doctor forgets laptop in a public location, organization loses a flash drive containing patient data, paper medical records lost in transit

Unknown: The breach source is unclear or has not been properly categorized. Some of these breaches are clearly one of the other categories. This category has not been used since January 2014.

Other: The breach source is unclear or has not been properly categorized. Some of these breaches are clearly one of the other categories. This category has not been used since December 2014.

Not Categorized: These breaches do not have any breach type label. We have labeled these as "Not categorized"

This data comes from the Health and Human Services Breach Portal. Section 13402(e)(4) of the HITECH Act requires this information to be made available.