32 Million Breached Patient Records in First Half of 2019 Double Total for All of 2018

Baltimore — August 1, 2019 — Six months into 2019, the volume of exposed patient data in the United States had already left the previous year far behind. The mid-year edition of the Protenus Breach Barometer tallied 31,611,235 patient records compromised between January and June, a figure roughly twice as large as the approximately 15 million records the tracker logged across the whole of 2018. Protenus, which sells an AI-driven compliance analytics platform used by health systems to monitor how staff and systems access patient information, publishes the Barometer as a running account of breaches disclosed to regulators or reported in the media.

The headline number is striking not only for its size but for how quickly it accumulated. The report counted 285 separate incidents over the half-year, describing the number of disclosed breaches as rising, and it confirmed that a pattern Protenus first flagged in 2016 is still holding: on average, the healthcare sector is reporting at least one data breach every single day.

One incident drove most of the total

Much of the jump can be traced to a single event. The largest breach disclosed in the first half of the year involved attackers who broke into the systems of a medical debt collection agency. According to the report, the intrusion came to light only after patient information surfaced in listings on the Dark Web, where stolen data is commonly bought and sold.

That one compromise touched more than 20 million patient records, with the attackers potentially able to view highly sensitive medical details. On its own, it accounts for close to two-thirds of all records exposed during the period, which illustrates how a single third-party vendor holding data on behalf of many providers can become a concentrated point of failure.

Hacking leads, insiders remain a persistent risk

External attacks were the dominant cause across the dataset. The Barometer attributed 60% of all breach incidents in the first half of 2019 to hacking, making it the most common way patient data left the control of the organizations responsible for it.

Threats from inside healthcare organizations were smaller in scale but still significant. Hospital insiders were responsible for exposing more than 3 million patient records during the six-month window. The report points out why these cases are hard to catch:

• Clinical and administrative staff need broad, fast access to records in order to treat patients, so improper lookups can blend in with legitimate activity.
• Because the access itself is authorized, misuse can go unnoticed for long periods, in some cases for several years.
• Detection therefore depends less on perimeter defenses and more on monitoring how credentials are actually used.

The company behind the tracker

Protenus positions the Barometer as a reference point for the industry, and the company’s own business sits squarely in the territory the report describes. Its platform applies artificial intelligence to access logs in order to flag suspicious behavior around patient records, the kind of insider activity the report says is so difficult to spot by conventional means.

The firm had picked up several industry recognitions in 2019 ahead of the mid-year release. It was named the KLAS Category Leader for Patient Privacy Monitoring, was included among Gartner’s “Cool Vendors” in healthcare artificial intelligence, and received an Innovation of the Year award in the data security category from Healthcare Informatics.

Readers should keep in mind that the Barometer is produced by a vendor with a commercial interest in privacy monitoring. Its figures are compiled from incidents that were publicly disclosed, so they reflect what organizations reported rather than every breach that may have occurred.

Why it matters

The mid-year numbers suggest that the scale of healthcare data exposure is now shaped less by the number of incidents than by where data is concentrated. When a single collections vendor can account for tens of millions of records, the security posture of business partners becomes as important as that of hospitals themselves. For providers, that points toward tighter vendor oversight and contract terms that address breach detection and disclosure.

The insider findings also underline a growing role for automated analytics. Manual audits struggle to separate routine clinical access from snooping, and tools that model normal behavior and surface anomalies are one response the sector is exploring, though their effectiveness depends on how well they are tuned and acted upon.

More broadly, health-related information now sits well beyond hospital walls. Consumer-health and wellness retailers, from pharmacies to online sellers in the nicotine pouch market, hold customer records of their own, and that data arguably warrants the same careful protection that regulators expect of clinical institutions.