While everyone's discussing the cost of breaches to hospitals…

Not surprisingly, a lot of the headlines  from the Ponemon study are that American hospitals spend about $6 billion/year due to data breaches, or around $1 million+ per hospital/per year.

But the costs of a data breach that result in a lawsuit are considerably higher.

In talking with Rick Kam, the President of ID Experts, about the Ponemon study, I asked him a question about the cost of lawsuits. He informed me that a big law firm had told him that defending a hospital against a lawsuit from a data breach would generally cost the hospital about $2-4 million, depending on if it goes to trial.  And if the lawsuit settles, double that figure, as the hospital often has to agree the plaintiff’s lawyer’s costs and expenses.

Given how expensive defending a lawsuit over a data breach can be, and that insurance probably doesn’t cover the whole thing, wouldn’t it make sense for large hospitals to invest a fraction of that money on improving security and data protection?   Do we need to start routinely suing entities that have had breaches to get them to realize the value of prevention — not just to their reputation and customer good will or churn, but because a lawsuit also hits them in the pocketbook?

Can hospitals really justify spending $60-80,000 year to hire a “social media manager” instead of spending that same money on security and data protection?  Let’s see; a social media manager vs. a person devoted to protecting your patients’ data?

The bottom line:  while some covered entities and their business associates do take security and privacy very seriously and are admirably transparent when there’s a failure, too many other entities need to give more of a damn.

While it might be nice to think “Oh, they just need more educating, maybe they misunderstood,”  I’m calling b.s. on that.  I have been told that some entities have decided it would be cheaper to just pay fines than to truly comply with HIPAA and HITECH requirements.  If that’s the case, then they need to be fined so heavily so that they never again consider noncompliance a viable option.

Indeed, I would go so far as to suggest that covered entities who have been found to be willfully violating HIPAA and HITECH requirements as a matter of policy or business practice, knowing that they are violating the law, should lose their accreditation as a health care entity.  If you can’t keep your accreditation if you risk patient safety or have less than adequate sanitation, why should you be able to keep your accreditation if you repeatedly demonstrate that you don’t take the protection of the privacy of your patients’ records seriously?

Yes, I know some will call me a privacy “wingnut” or some other term that they’ll use pejoratively.  To them I say:  it is more than 7 years since HIPAA was passed.  Enough is enough with the excuses for noncompliance.