What is an example of a data breach in healthcare?

Editorial team Published on

A healthcare data breach is any unauthorized access, use, disclosure, loss, or theft of protected health information (PHI) or patient records.

Prominent Real-World Examples

  • The Change Healthcare Breach (2024): Considered the largest healthcare data breach in U.S. history, cybercriminals (attributed to the group ALPHV/BlackCat) attacked Change Healthcare, a subsidiary of UnitedHealth Group's Optum division, affecting roughly 192.7 million people. It disrupted payment and billing systems across the country.
  • The Anthem Blue Cross Breach (2015): Hackers used spear-phishing and stolen employee credentials to access an enterprise data warehouse. This compromised the names, birth dates, and Social Security numbers of 78.8 million individuals.
  • Everyday Human Error & Theft Examples:
    • An employee accidentally emails a spreadsheet containing patient names and diagnoses to the wrong external recipient.
    • A staff member leaves an unencrypted laptop or USB drive containing patient records in a car, where it is stolen.

Common Causes

  • Cyberattacks and Hacking: Ransomware or malware that locks down hospital electronic health records (EHRs) or steals data from network servers.
  • Phishing: Tricking employees into handing over login credentials through fake emails.
  • Insider Threats: Unauthorized employees looking up medical files of high-profile patients or family members out of curiosity.
  • Improper Disposal or Loss: Tossing paper charts or unencrypted hardware into regular trash bins or misconfiguring public cloud storage.

What are the four most common causes of healthcare data breaches?

The four most common causes of healthcare data breaches are hacking and IT incidents, human error, unauthorized internal access, and third-party vendor vulnerabilities.

1. Hacking and Cyberattacks

  • Ransomware and Malware: Malicious software locks critical hospital databases and systems until a financial ransom is paid.
  • Phishing: Fraudulent emails, texts, or calls trick staff into surrendering login credentials.
  • Network Exploits: Attackers target unpatched software, outdated legacy systems, and weak server configurations.

2. Human Error

  • Misdirected Disclosures: Staff accidentally send sensitive patient files or Protected Health Information (PHI) to the wrong email address or recipient.
  • Improper Disposal: Physical paper records or digital storage drives are thrown away without proper shredding or degaussing.
  • Accidental Loss: Laptops, phones, or paper charts are misplaced or left in public spaces.

3. Unauthorized Internal Access (Insider Threats)

  • Snooping: Employees look at electronic health records (EHR) of patients they are not treating and who are outside their authorized scope of work.
  • Malicious Theft: Disgruntled or unethical staff members intentionally steal patient data for financial gain or identity theft.
  • Careless Sharing: Workers ignore security policies by sharing passwords or leaving active workstations unattended.

4. Third-Party Vendor Vulnerabilities

  • Supply Chain Access: External business associates, medical billing companies, or cloud service providers suffer breaches that expose shared patient records.
  • Weak Vendor Security: Third-party partners with lower security standards create entry points into primary healthcare provider networks.

Can you give me an example of a data breach?

A classic example of a data breach is the 2017 Equifax data breach, where hackers accessed private records of roughly 147 million Americans.

What Happened

  • The Cause: Hackers exploited a known software flaw in a web framework called Apache Struts. Equifax failed to install the security patch even though it was available for two months.
  • The Stolen Data: Attackers stole Social Security numbers, birth dates, home addresses, and driver's license numbers.
  • The Impact: Equifax paid a massive settlement of up to $700 million following investigations by the FTC and consumer protection groups. You can read more historical breakdowns on the UpGuard Blog.

What is considered a breach in healthcare?

In healthcare, a breach is any unauthorized access, use, or sharing of protected health information (PHI) that puts a patient's privacy or security at risk.

What is Protected Health Information (PHI)?

PHI is any data that links a specific person to their medical care. It includes:

  • Names and addresses
  • Dates of birth or admission
  • Medical record numbers or diagnoses
  • Social Security numbers
  • Account balances or billing details

Common Examples of Healthcare Breaches

  • Unauthorized Snooping: An employee looks at a patient file or a celebrity's medical chart without a valid job reason.
  • Wrong Recipient: A staff member accidentally emails, texts, or mails private patient documents to the wrong person.
  • Lost or Stolen Devices: A laptop or USB drive containing unencrypted patient data is stolen from a car or lost in public.
  • Improper Disposal: Paper records containing patient names and medical data are thrown into an open dumpster instead of being shredded.
  • Cyberattacks: Hackers break into a hospital computer system to steal files or hold data for ransom.

The Rules and Exceptions

Under the HHS Breach Notification Rule, any improper sharing of unencrypted patient data is automatically considered a breach.

A healthcare organization can only avoid calling an incident a breach if they prove there is a very low chance the data was compromised. If the data is safely encrypted or destroyed properly, it is usually protected from this rule.

Can you sue for a healthcare data breach?

Yes, you can sue for a healthcare data breach, but you cannot sue directly under federal HIPAA laws because the statute does not provide a private right of action.

Legal Options and Claims

  • State Lawsuits: You can file a lawsuit using state-level legal claims such as negligence, breach of contract, invasion of privacy, or breach of fiduciary duty.
  • HIPAA as Evidence: While you cannot sue under HIPAA directly, violations of HIPAA standards can be used in state court to establish that a healthcare provider failed their legal duty of care (negligence per se).
  • Class Action Lawsuits: If a large-scale breach affects many people, patients often join class-action lawsuits against the responsible hospital or company.

Requirements to Sue

  • Standing: You must show that your specific medical or personal data was actually compromised in the breach.
  • Damages: You generally need to prove demonstrable harm, such as direct financial loss from identity theft, fraudulent medical billing, or severe emotional distress. Some state consumer privacy statutes allow for statutory damages without proving explicit identity theft.

Alternative Actions

  • File an OCR Complaint: You can report the violation to the Office for Civil Rights (OCR) under the Department of Health and Human Services, which investigates breaches and can issue heavy financial penalties to the facility.

Data breach may impact several Virginia hospitals and medical practices

9 related questions found

What are some examples of healthcare data breaches?

Major healthcare data breaches include massive cyberattacks, ransomware incidents, and vendor vulnerabilities that have exposed millions of patient records.

Notable Examples of Healthcare Data Breaches

  • Change Healthcare (2024): Considered the largest healthcare data breach in U.S. history, a ransomware attack via compromised remote-access credentials without multi-factor authentication impacted an estimated 192.7 million individuals, severely disrupting national claims and pharmacy processing. Track the ongoing scope through the UpGuard Analysis on Healthcare Breaches.
  • Anthem / Elevance Health (2015): A massive cyberattack compromised the personal information, including Social Security numbers and birthdays, of nearly 78.8 million current and former customers.
  • Magellan Health (2020): A ransomware and phishing attack impacted over 365,000 individuals directly and spread across multiple associated healthcare providers and pharmacy networks.
  • Integris Health (2023–2024): A cyberattack compromised the personal and sensitive patient information of roughly 2 million individuals.

Common Causes Behind the Breaches

  • Hacking and IT Incidents: Malicious external network intrusions, including ransomware and credential theft, account for over 80% of recent large healthcare breaches.
  • Third-Party Vendors: Incidents involving administrative partners or IT service providers (such as WebTPA or Nuance-related vendor exposures) frequently put millions of records at risk.
  • Human Error: Misdirected emails, improper record disposal, or lost unencrypted devices remain persistent internal risks.

What is the #1 cause of data breaches?

Human error—such as falling for phishing scams, misusing data, or using weak passwords—is the number one cause of data breaches.

Industry studies, including the Verizon Data Breach Investigations Report (DBIR), show that the vast majority of security incidents involve the human element. Even the best technical firewalls fail when a person is tricked or makes a simple mistake.

Top Ways Human Error Causes Breaches

  • Phishing and Social Engineering: Attackers trick people into clicking bad links or giving up login codes.
  • Weak or Reused Passwords: People use simple words or the same password on many websites.
  • System Misconfiguration: Workers leave cloud storage open to the public by accident.
  • Lost or Stolen Devices: Employees leave laptops or phones in public places.

How to Prevent These Breaches

  • Train Workers: Teach staff to spot fake emails and weird requests.
  • Use Multi-Factor Authentication (MFA): Require a second code or phone tap to log in.
  • Use Password Managers: Stop people from reusing or writing down weak passwords.
  • Limit Data Access: Give workers access only to the files they need for their jobs.

How do you know if you were in a data breach?

You can check if your personal information was exposed in a data breach by using free online lookup tools or reviewing official company notifications.

Use Free Breach-Check Tools

  • Type your email address into trusted lookup tools like Have I Been Pwned or F-Secure Identity Theft Checker to see if your data appears in known leaks.
  • Review alerts from your password manager or browser, which often flag if your saved credentials were exposed online.
  • Search active security incidents and data dumps on platforms like DataBreach.com.

Watch for Direct Notices and Signs

  • Company notifications: Companies legally required to report leaks will often email or mail you directly if your specific records were compromised.
  • Unusual activity: Look out for unexpected password reset requests, strange login alerts, or unrecognized bank charges.
  • State registries: If you live in California, you can browse major disclosures through the California Attorney General Data Breach Reports.

What are the top 10 data breaches of all time?

The largest data breaches and exposures of all time, ranked by the total volume of records or accounts compromised, include massive super-user aggregations and specific corporate hacks.

Top 10 Data Breaches and Exposures

  1. The Mother of All Breaches / MOAB (2024) — 26 billion records
    Discovered by security researchers, this massive 12-terabyte dataset compiled information from thousands of previous leaks, combining credentials from LinkedIn, Twitter, Adobe, and others into a single repository.
  2. Cam4 (2020) — 10.8 billion records
    An unsecured, password-free Elasticsearch database exposed logs containing names, email addresses, payment histories, and private chat transcripts from the adult streaming site.
  3. RockYou2021 (2021) — 8.4 billion records
    A large dark-web compilation leak that packed billions of plaintext usernames and passwords intended for credential-stuffing attacks.
  4. Yahoo (2013–2014) — 3 billion accounts
    Compromising every single account in existence, separate state-sponsored intrusions exposed names, phone numbers, and hashed passwords, reducing Yahoo's acquisition price by $350 million.
  5. National Public Data (2023–2024) — 2.9 billion records
    A Florida-based background check data broker suffered an unauthorized access leak exposing millions of Social Security numbers and personal details, leading to the company's bankruptcy.
  6. Aadhaar / UIDAI (India, 2018) — 1.1 billion records
    A state ID database vulnerability exposed names, 12-digit identity numbers, and biometric data access points for nearly all Indian citizens.
  7. Shanghai National Police (2022) — 1 billion records
    An unsecured cloud database leaked extensive citizen data, including criminal histories, national IDs, and mobile numbers.
  8. First American Financial Corporation (2019) — 885 million records
    A misconfigured external server accidentally exposed banking transactions, mortgage records, and Social Security numbers.
  9. Verifications.io (2019) — 800 million records
    An unprotected enterprise email validation database exposed corporate and personal email lists, names, phone numbers, and demographic data.
  10. Facebook (2019) — 533 million to 540 million records
    Scraped user data—including phone numbers, Facebook IDs, and personal names—was leaked publicly on a low-level hacking forum from an older server vulnerability.

What are 80% of all data breaches caused by?

Approximately 80% to 90% of data breaches and security incidents are caused by human error or related human factors, such as employee mistakes, falling for phishing scams, or poor configuration.

Key Causes Tied to the 80% Figure

  • Human Error and Mistakes: Studies (such as research from Stanford University) frequently cite that roughly 88% of data breaches stem from employee mistakes like misdirected emails or weak security habits.
  • Cloud Misconfigurations: According to research and advisory firms like Gartner, cloud misconfigurations—which are typically driven by user and administrative setup mistakes—play a role in roughly 80% of data security incidents.
  • Phishing and Social Engineering: Industry reports note that 80% to 95% of cyberattacks begin with a phishing attempt targeting a user.
  • Identity and Access Failures: Between 70% and 80% of security incidents trace back to compromised credentials, poor password hygiene, or identity system failures.