Healthcare Data Breaches Can Push Patients Away, Says Survey

[Audrey McNeil <audrey () riskbasedsecurity com>]

http://healthitsecurity.com/2015/03/24/healthcare-data-breaches-can-push-patients-away-says-survey/

Healthcare data breaches can be devastating for patients and the healthcare
facility that was attacked. The organization could face severe penalties
from the Department of Health & Human Services (HHS) if it is deemed that
it violated HIPAA, while patients could spend years working to recover from
having their personal information accessed.

But if a recent survey is any indication, healthcare data breaches can also
deter individuals from choosing a particular provider. Sixty-five percent
of surveyed adults said that they would avoid providers that experience a
healthcare data breach, according to a TransUnion survey. Moreover, 46
percent of those surveyed said they expect a notification within one day of
the breach, while 31 percent said that they expect to receive a response or
notification within one to three days.

TransUnion conducted an online survey of approximately 1,200 US adults who
received medical care at a doctor’s office, clinic or hospital in the past
two years.

“The hours and days immediately following a data breach are crucial for
consumers’ perceptions of a healthcare provider,” TransUnion Healthcare
President Gerry McCarthy said in a statement. “With the right tools,
hospitals and providers can quickly notify consumers of a breach, and
change consumer sentiments toward their brand.”

Even with consumers wanting quick notification, HHS requires that covered
entities give notice “without unreasonable delay” to individuals or no
later than 60 days following the discovery of a breach. If there is
outdated contact information for 10 or more individuals, then the covered
entity must post the notice on its web site’s home page for at least 90
days or give the notice to major print or broadcast media where the
affected individuals likely live.

The HIPAA breach notification rule also requires that covered entities and
their business associatesnotify necessary parties after unsecured protected
health information (PHI) is compromised. While many organizations make
announcements even when PHI is not involved, HIPAA only applies to PHI.

The TransUnion survey also found that the age of consumers would affect
whether or not they choose to switch healthcare providers following a data
breach. Seventy-three percent of patients ages 18 to 34 said they were
likely to switch healthcare providers after a data breach, while 64 percent
of patients older than 55 said they were not likely to consider switching
healthcare providers.

“Older consumers may have long-standing loyalties to their current doctors,
making them less likely to seek a new healthcare provider following a data
breach,” McCarthy said. “However, younger patients are far more likely to
at least consider moving to a new provider if there is a data breach. With
more than 80 million millennials recently entering the healthcare market,
providers that are not armed with the proper tools to protect and recover
from data breaches run the risk of losing potentially long-term customers.”

The survey also found the following results:

72 percent of respondents expect providers to offer at least one year of
free credit monitoring after a breach.
59 percent of those surveyed said they expect a dedicated phone hotline for
questions.
55 percent of respondents expect a dedicated website with additional
details.

_______________________________________________
Dataloss Mailing List (dataloss () datalossdb org)
Archived at http://seclists.org/dataloss/
Unsubscribe at http://lists.osvdb.org/mailman/listinfo/dataloss
For inquiries regarding use or licensing of data, e-mail
        sales () riskbasedsecurity com 

Supporters:

Risk Based Security (http://www.riskbasedsecurity.com/)
YourCISO is an affordable SaaS solution that provides a comprehensive information security program that ensures focus 
on the right security.  If you need security help or want to provide real risk reduction for your clients contact us!