Context Security

Maybe those DLP $$$/record breached stats aren’t so far off…

by seth on Jun.16, 2010, under Security

I have often scoffed at some of the numbers used to cost justify Data Leakage Prevention (DLP) purchases.  While I agree there is a pretty serious need for redoubled efforts at preventing (and moreover detecting) sensitive data leaving an organization’s control, I haven’t found myself persuaded by most of the “studies” that show crazy high $$$/record costs.  Perhaps I am jaded, but often these reports feel as if they were  funded by those with a vested interest in the results pointing in a particular direction (that of “buying our product makes cents” [sic]).

Fast forward to the DarkReading article that I first noticed this past weekend.  In 2008, California passed two laws Assembly Bill 211 and Senate Bill 541, which were aimed at further incentivizing health care providers to ensure the privacy of medical records.  The laws went into effect 01/01/2009, but last week marks the first time that the California Department of Public Health (CDPH) has wielded its expanded power of  fining facilities up to $25,000/per record for allowing unauthorized access to a patient’s medical record.  CDPH has published the details here.

Five separate facilities were fined a total of $675,000.  In total, the confidentiality of 245 medical records were breached.  Although the fines varied (sometimes based on the number of people that accessed the records), in aggregate, that puts the cost/record breached at $2,755. A far cry from the $25,000/record mark (though some instances did receive that level of penalty), but still a substantial cost.  Given the relative low volume (when compared to the numbers frequently seen in credit card breaches), it is hard to anticipate if thousands or tens of thousands of records were breached whether the penalties would remain this high.

While I welcome the increased penalties that might help persuade organizations to make further strides in ensuring the confidentiality of sensitive data, I am worried about the (un)anticipated side effects.  The CDPH has made the sanitized reports available on their website.  One phrase seems to be a fairly common theme, “the facility reported the breach”.  I applaud the facilities for reporting these breaches of medical privacy, but will every facility be so forthcoming given the potential for fines.  Would a private for-profit hospital be hesitant to report the breach of 1,000 records knowing that it could  result in $25,000,000 in fines?  I hope so, but something tells me that not every health care provider would reach the conclusion that self-reporting is in their best interest.  As a parting shot, know what the cost/day fine is if it is found that a facility didn’t report a breach? A hundred bucks…  Seriously?  Not sure a benjamin is a strong incentive for early reporting…

:,
1 comment for this entry:
  1. Peter Abatan
    June 17th, 2010 on 03:56

    Seth, interesting post. I must say that I was initially skeptical about the cost of a data breach per record. However, I am beginning to realize that those figures are conservative. Heartland is a typical example.

    The Ponemon Institute has been one of the pioneers analyzing cost per record breached and is not associated with any DLP vendor or IT security vendor. The guys at Ponemon are definately worth checking out.

Leave a Reply

Looking for something?

Use the form below to search the site:

Still not finding what you're looking for? Drop a comment on a post or contact us so we can take care of it!

Archives

All entries, chronologically...