In one such incident, over 1 million patients in Tennessee were victims of a security breach. Hard drives containing confidential information were stolen from the Eastgate offices of BlueCross BlueShield, an incident that has already cost the insurance provider $7 million in the early stages of its investigation and damage control.

Hayes predicts that these numbers will only increase in coming years.


"There's a constant number of breaches being reported every month," said Hayes. "And I don't see that number going down in the future."

In the report, Redspin offers broad policy recommendations to prevent future security breaches, including a security system plan, incident detection and reporting programs, and improved protection for portable media.

However, the picture is still incomplete. The Breach Notification Rule of the HITECH Act went into effect August 2009, so the report is only an early snapshot of the problem.

Although Hayes said that the initial numbers are surprising, the real interest is whether there will be any improvements in security in the coming months. "We are going to be watching the breaches occurring in 2011, and we'll put together a similar report next year," said Hayes.

Back to HCB News

More Industry Headlines