Your Hospital Data Has Been Breached and You Feel Sick About It: What to Do Right Now

You scan the form letter with dread: Yep, it’s happened again. Your hospital data was compromised. The letter may specify what was targeted (Social Security number, name, address, email), but invariably it ends with the offer of a complimentary year in an identity theft protection system and an assurance that your data privacy matters.

Hospitals seem like a target for only the most heartless attacker. Not only are these online attacks piling more worries onto patients who may already be dealing with a health crisis, but it’s also true that sometimes cybercriminals hold people’s stolen health information for ransom, which could potentially delay life-saving treatment.

As with other online attacks, cybercriminals are following the money, and there’s big money in health care targets. 

“An identity string on the dark web can be worth about $1,000 in resale value,” said Michael Bruemmer, vice president of global data breach resolution and consumer protection at consumer credit bureau Experian. “That’s why the hackers are targeting [health care] and the hospital companies.”

Theft of hospital data is on the rise

Data breaches at hospitals, and health care organizations in general, are growing exponentially. Of Experian’s business clients, health care represented 38% of the breaches logged in 2023, and this year is pacing even further ahead.

“Hospital and medical environments are generally distributed, and very hard to secure,” Bruemmer said. “There’s lots of cracks in the armor and ways to get in, even though most breaches emanate from human error.”

The threat landscape isn’t going to improve over time. And cybercriminals are even leaning on new advances in artificial intelligence.

“We all know that the hackers are staying way ahead,” said Bruemmer. “They’re taking much better advantage of AI than the defenders are.”

Personal information — even private photos — can be stolen

Ransomware attacks — when attackers lock computer users out of the system, or threaten to release private information until they’re paid off in some way — make for dramatic headlines. A 2017 ransomware attack shut down computers and stopped operations at a number of institutions operated by Britain’s National Health Service. Doctors couldn’t access patient histories, urology clinic staffers were unable to work, and emergency room patients were turned away, as noted by The New York Times.

This past February, a ransomware attack shut down UnitedHealth Group’s Change Healthcare tech unit, part of the nation’s biggest health care payment system. The attack disrupted UnitedHealth’s ability to process insurance claims, transmit prescription requests, and more. UnitedHealth revealed that patients’ personal information was compromised, and it paid a ransom to the Russia-based cybercriminals.

As of early June, affected consumers and providers had filed at least 49 lawsuits against UnitedHealth, saying the company had failed to secure patient data and to keep payments flowing.

Refusing to pay a ransom might seem like the right decision to make, so as not to encourage future attacks. But cybercriminals might not be bluffing. The New York Times cited a horrific ransomware attack on Pennsylvania’s Lehigh Valley Health Network, believed to be by the same online attackers who attacked Change Healthcare. When Lehigh Valley Health Network refused to pay the ransom, the attackers posted nude photos online that they’d stolen, showing patients receiving breast cancer treatment. One of the victims later sued the health network.

Thankfully, ransomware attacks aren’t as frequent as other types of assaults — yet. A report in HIPAA Journal, which covers news about the Health Insurance Portability and Accountability Act, said that nearly 80% of data breaches in 2023 didn’t involve ransomware.

Vital health information could be altered

As you might imagine, a breach of health care data puts more sensitive information at risk than other breaches. 

“Generally, anything that you tell a doctor or that you’re being treated for could potentially be used or misused,” said Lawrence Pingree, vice president of emerging technologies and trends at research and consulting firm Gartner. 

Personally identifiable information such as Social Security numbers, birth dates and credit card information can be taken in any breach, whether at a department store or an employer. The difference with breaches of health care data is that stolen information could include your full medical record, detailing your diagnoses, medications and private conversations with your doctors. And hospital attackers could cause further turmoil by altering data in records — what if they changed someone’s blood type, allergies or other critical data?

Once your medical record is sold on the dark web, the identity theft component can look similar to what you find with other data breaches. An online attacker might have enough info to open new credit cards in your name, or file false claims to Medicare. 

Pingree takes the risk one step further, noting that cybercriminals could use your personal details to improve the believability of other, targeted attacks, like phishing.

Why are hospitals easy targets?

Hospital systems are complex entities with multiple cybersecurity risk vectors. Often, the risk lies with one of the many third-party vendors and service providers that help keep the larger hospital infrastructure running.

This is what happened in the Change Healthcare ransomware cyberattack. The complexity of a health care breach carries over to the impact, with both the health care organization and its patients potentially affected. 

“Cyberattacks have patient care consequences,” said Bruemmer. 

As with everything in cybersecurity, your hospital data is at risk from the weakest link in the hospital’s tech stack chain, and that chain includes all vendors and companies that work with the hospital. 

“The complexity of large enterprises is a really big problem,” said Pingree.

Large enterprises have diverse and older systems, which means keeping the technology updated can be extremely difficult. “[It’s] not as easy as you or me just hitting the update button on Windows,” Pingree added. “Which is why you end up having systems that are less prepared for an attacker or modern-day threats.” 

What to do after a hospital data breach

Hospital health care systems are bound by HIPAA rules, which require organizations to notify patients within 60 days of discovering a breach. HIPAA also outlines that the organization disclose the type of information involved in the breach, the steps you should take to protect yourself, and what the organization is doing to protect against future breaches. For breaches involving more than 500 records, organizations must notify both the Department of Health and Human Services and the media. 

The Change Healthcare case was so unprecedented that the HHS Office for Civil Rights publicly confirmed that the compromised health care entity, not individual providers, must be responsible for notifying patients.

When you receive that data breach notification, you’ll want to stay more alert and check your financial and insurance records more frequently.

“I wouldn’t run out and be super afraid because my health care data is breached, but certainly, unsavory characters could use it,” said Pingree. 

The three key things to worry about after a breach are identity theft, insurance fraud and changes to your health care record. 

But I wasn’t even in the hospital!

Even if you weren’t in the hospital recently, chances are you have personally identifiable information tied to a hospital health care system if you’ve ever been treated there, or are a member. 

A larger hospital might own the small clinic or practice you use for other, even minor, medical care, meaning your information is now part of its computer system — and vulnerable to its breaches.

What steps should you take to protect yourself?

For starters, treat this as you would any other case of financial data or identity theft: change your passwords, check with the three credit rating agencies to put a fraud alert on your account, and freeze your credit cards, said Garcia.

Pingree seconds this advice: “The immediate thing anybody should do is freeze your credit, just as a matter of best practice,” he said. You’ll need to do so separately with all three credit bureaus: Experian, Equifax, and TransUnion. 

Experian’s Bruemmer offers even more suggestions, like not answering any strange phone calls or clicking any email or text message links. “Regularly check your credit file for anything that’s strange, like new inquiries or something you don’t recognize,” he said.

And Bruemmer cautioned that even though some doctor’s offices may still ask for it, “you never have to provide your Social Security number.” Use two-factor authentication or password-less options where possible, too. He recommends using a password manager to help manage your passwords. (See CNET’s picks for the best password manager in 2024.) 

Garcia also suggested taking advantage of any offer of credit monitoring, and if you didn’t receive such an offer from the hospital or clinic, sign up for a service on your own. (Check out CNET’s guide to the best identity theft and protection monitoring services for 2024.)

What else should you monitor?

Since your health record was compromised, you need to watch for a few more things beyond what you’d look for in a standard case of identity theft. Watch for suspicious or unauthorized activity on any accounts you’ve used to pay for your health care, such as credit cards or a health care savings account. And keep an eye out for false medical claims and bills, since you’re now a prime target for insurance fraud. 

Garcia also suggested you double-check your own health records. 

“I’ve not been informed of instances where large numbers of health records have been corrupted or altered,” he said, “but nevertheless, one should always be checking.”