--- title: Medical Records Worth More Than Credit Card Info - SCA Security description: There has been a lot of information all over the news about recent large breaches in the healthcare industry. Millions of individuals have been affected by these breaches in the healthcare industry. The healthcare market is the hottest place for cyber-criminals to attack... image: https://blog.scasecurity.com/hubfs/Imported_Blog_Media/Optimized-AdobeStock_635083842-1200x580.jpg --- [727-571-1141 Talk to an Expert](tel:727-571-1141) [info@scasecurity.com Email Us](mailto:info@scasecurity.com) [![sca-logo-r](https://blog.scasecurity.com/hs-fs/hubfs/sca-logo-r.png?length=190&name=sca-logo-r.png)](https://scasecurity.com/) ☰ - [Home](https://scasecurity.com/) - [Security](https://scasecurity.com/security/) - [Email Phishing & Employee Training](https://scasecurity.com/anti-phishing-training-with-phished-io/) - [Vulnerability Assessments](https://scasecurity.com/security/vulnerability-assessments/) - [Penetration Testing](https://scasecurity.com/security/penetration-testing/) - [Applications](https://scasecurity.com/security/applications/) - [Controls](https://scasecurity.com/security/controls/) - [Centurion ESO](https://scasecurity.com/executive-security-officer/) - [Consulting](https://scasecurity.com/security/consulting/) - [Risk & Compliance](https://scasecurity.com/compliance/) - [CMMC](https://scasecurity.com/cybersecurity-maturity-model-certification/) - [HITRUST](https://scasecurity.com/hitrust/) - [Federal](https://scasecurity.com/compliance/federal/) - [State](https://scasecurity.com/compliance/state/) - [Industry](https://scasecurity.com/compliance/industry/) - [Cybersecurity Risk Assessment](https://scasecurity.com/security/risk-assessment/) - [NIST Cybersecurity Framework Assessment](https://scasecurity.com/compliance/nist-framework/) - [AI Risk Management Services](https://scasecurity.com/ai-risk-management-services/) - [Governance](https://scasecurity.com/compliance/governance/) - [Industries](https://scasecurity.com/industries/) - [Financial Services](https://scasecurity.com/industries/financial-services/) - [Healthcare](https://scasecurity.com/industries/healthcare/) - [Government/Public Sector](https://scasecurity.com/industries/government-public-sector/) - [Title/Real Estate](https://scasecurity.com/industries/title-real-estate/) - [Technology](https://scasecurity.com/industries/technology/) - [Manufacturing](https://scasecurity.com/industries/manufacturing/) - [Professional Services](https://scasecurity.com/industries/professional-services/) - [Automotive](https://scasecurity.com/automotive/) - [Higher Education](https://scasecurity.com/higher-education/) - News & Resources - [Blog](https://blog.scasecurity.com) - [Events](https://scasecurity.com/event/) - [Case Studies](https://scasecurity.com/case-studies/) - [Recorded Webinars](https://scasecurity.com/recorded-webinars/) - [SCA Breach Notification Guide](https://scasecurity.com/breach-notification-guide/) - [HIPAA Security Audit Checklist](https://info.scasecurity.com/hipaa-audit-checklist) - [Cybersecurity Checklist for Insurance Providers](https://info.scasecurity.com/cybersecurity-checklist-for-insurance-providers) - Company - [About Us](https://scasecurity.com/about-us/) - [Leadership](https://scasecurity.com/leadership/) - [Affiliates](https://scasecurity.com/affiliates/) - [Career Opportunities](https://scasecurity.com/career-opportunities/) - [Testimonials](https://scasecurity.com/testimonials/) - [Contact Us](https://scasecurity.com/contact-us/) #### Menu Home Security › Email Phishing & Employee Training Vulnerability Assessments Penetration Testing Applications Controls Centurion ESO Consulting Risk & Compliance › CMMC HITRUST Federal State Industry Cybersecurity Risk Assessment NIST Cybersecurity Framework Assessment AI Risk Management Services Governance Industries › Financial Services Healthcare Government/Public Sector Title/Real Estate Technology Manufacturing Professional Services Automotive Higher Education News & Resources › Blog Events Case Studies Recorded Webinars SCA Breach Notification Guide HIPAA Security Audit Checklist Cybersecurity Checklist for Insurance Providers Company › About Us Leadership Affiliates Career Opportunities Testimonials Contact Us [727-571-1141 Talk to an Expert](tel:727-571-1141) [info@scasecurity.com Email Us](mailto:info@scasecurity.com) May 18, 2015 # Medical Records Worth More Than Credit Card Info By: SCA Editor ![](https://blog.scasecurity.com/hubfs/Imported_Blog_Media/Optimized-AdobeStock_635083842-1200x580.jpg) There has been a lot of information all over the news about recent large breaches in the healthcare industry.  Millions of individuals have been affected by these breaches in the healthcare industry.  The healthcare market is the hottest place for cyber-criminals to attack.  There are many reasons for this… the simplest reason is they are the easiest target to hit.  The lack of resources, experience and information security awareness training play a major role in why healthcare organizations are being targeted and successfully hit by these cyber-criminals. “Organizations in the healthcare space are not playing their ‘A game’ in terms of security and data protection,” said Larry Ponemon, founder and CEO of the Ponemon Institute. “There are some exceptions, but generally speaking, healthcare providers either lack the resources, staff or the technical innovations to meet the changing cyber-threat environment.” ([http://www.nbcnews.com/tech/security/health-industry-cant-protect-your-records-hackers-report-n355401 5/8/2015](https://www.nbcnews.com/tech/security/health-industry-cant-protect-your-records-hackers-report-n355401)) For those of you who are not already in the know on the subject, the Ponemon Institute conducts independent research on privacy, data protection and information security policy. Their 2015 Study on Privacy and Security of Healthcare Data is based on information provided by healthcare organizations large and small, as well as related businesses that often deal with healthcare records. The report concluded that no healthcare organization, regardless of size, is immune to a data breach. And in fact, half of all the organizations surveyed have “little or no confidence” in their ability to detect every theft or loss of patient data. Other key findings: - 91 percent of the healthcare organizations surveyed had one data breach during the past two years; 39 percent experienced two to five breaches and 40 percent had more than five! - Data breaches are costing the healthcare industry $6 billion a year! Cases of medical identity theft have nearly doubled in the last five years, from 1.4 million adult victims to more than 2.3 million in 2014.  ([http://www.nbcnews.com/tech/security/health-industry-cant-protect-your-records-hackers-report-n355401 5/8/2015](https://www.nbcnews.com/tech/security/health-industry-cant-protect-your-records-hackers-report-n355401)) The “Fifth Annual Benchmark Study on Privacy and Security of Healthcare Data” by the research firm Ponemon Institute concludes that criminal attacks in healthcare are up 125 percent since 2010. Cybercriminal incidents involving external and internal actors were the leading cause of a data breaches over the past two years, the study shows. In previous studies, lost or stolen computing devices had consistently been the top breach culprit. (By Marianne Kolbasuk McGee, May 6, 2015. Healthcareinfosecurity.com) All of this news coupled with the findings from the original pilot HIPAA Audit Program illustrates that there is a strong need for healthcare organizations to strengthen their information security posture and programs.  This is an area that is critical to protecting the American Public. Most telling is the fact that Medical Records are now more valuable to cyber-criminals than credit card information. Rick Kam, U.S. president and co-founder of security software vendor ID Experts, which sponsored the Ponemon study, tells ISMG that stolen healthcare information is currently valued at about $60 to $70 per record by ID theft criminals, while the current value of credit card information is about 50 cents to $1 per record. “We see recognition of medical ID theft being a problem, but we don’t see many healthcare providers stepping up” in addressing the issue, he says. The Ponemon study found that nearly two-thirds of healthcare organizations and business associates do not offer any medical identity theft protection services for patients whose information has been breached. The Ponemon study found that information most often stolen in these targeted healthcare sector attacks include medical files and billing and insurance records. (By Marianne Kolbasuk McGee, May 6, 2015. Healthcareinfosecurity.com) There are steps you can take to gain a better security posture and ensure that if you do suffer an attack or breach, you will be able to respond effectively.  If you are a healthcare organization, keep in mind, you are required under HIPAA regulations to complete periodic, thorough and comprehensive Security Risk Assessments.  This will allow you to gain a better understanding of your strengths and weaknesses in regard to securing patient information.  Furthermore, you are required to have a risk management plan in place that include having a security risk analysis completed annually as part of your process as well as an incident response plan. The more thorough you are the better off your institution will be.  This will result in your practice being better positioned to withstand malicious activity and regulatory scrutiny.  Having a risk management plan in place, completing annual risk assessments and following through on mitigation plans will have several positive impacts on your practice.  It will decrease the likelihood of downtime and its impact on patient care.  Moreover, it will reduce the risk of a Data Breach, along with the associated penalties and negative publicity.   A data breach may have lasting impact on your reputation, as well as the overall confidence a prospective patient may have in your practice.  A solid risk assessment will ensure you are compliant with HIPAA/HITECH and the CMS Incentive Program mandates. Here are some things to keep in mind as you review your physical, administrative and technical safeguards as part of your risk assessment. From a physical standpoint, be sure to check on the following key aspects of your environment: - external door locks and alarms - emergency water and power shut off - smoke alarms and fire extinguishers - internal locks or monitoring for secured areas - server or wiring rooms - paper charts (where and how they are stored) - medication closest or cabinet and locks - laptops and workstations - patient and visitor logs - internal separation between front office and back office Administrative safeguards that need to be reviewed include your policies and procedures.  This is an area that is often overlooked.  Having a policy or procedure in place does not meet regulatory requirements. You should have a documented, ***written*** policy, backed up with standards and procedures that all employees understand.  Per HIPAA, there are numerous requirements that must be met and each one of these criteria has specific implementation requirements that must be documented.  Your workforce clearance policy may say how you provide clearance to your employee.  It must also include whether or not you complete background checks, what type of check you do, whether you re-screen and how frequently you do so. The policies and procedures you have in place will guide how you protect PHI. When reviewing your technical safeguards, please keep in mind that some of these will also be covered in your administrative safeguards – including your information security policies.  Please keep in mind that new threats evolve on a daily basis from viruses, malware and the like, but you also need to take the human factor into consideration.  Phishing is growing more and more prevalent and you must inform your workforce on these threats and how to handle them appropriately.  You must also monitor your logs, keep up to date with security updates, patches and antivirus software. Encryption is also a critical concern.  Of the breaches that have led to large fines over the last few years, nearly all of them included an unencrypted piece of machinery and failure to complete a thorough and comprehensive security risk assessment.  The only way to ensure you are protecting PHI in the case of a lost or stolen device is to have Full Disk Encryption that meets the NIST standard definition.  Although there are alternative measures available, the only acceptable way to ensure protection is Full Disk Encryption. There are many options available to you regarding encryption, look into the options that best meet your practices needs and financial considerations. In a world where cyber-criminals are attacking in greater frequency across a broad range of industries, it is vitally important that healthcare organizations take the appropriate steps to mitigate the likelihood of breaches. Medical Records are selling for $60.00-70.00 per record and credit card information is $0.50-1.00 per record, the risk is greater than ever before and not likely to go away.  It is time for healthcare organizations to bring their information security “A” game. \[/vc\_column\_text\]\[/vc\_column\]\[/vc\_row\] #### Subscribe Email\* Notification Frequency [Blog](https://blog.scasecurity.com/tag/blog) [February 07, 2025 Preparing for 2025 HIPAA Changes: What Healthcare Organizations Need to Know](https://blog.scasecurity.com/preparing-for-2025-hipaa-changes-what-healthcare-organizations-need-to-know) [October 23, 2024 What is a Vulnerability Assessment (and Why You Need One)](https://blog.scasecurity.com/blog/what-is-a-vulnerability-assessment) [October 10, 2024 Understanding the Risks and Mitigation of Phishing Attacks](https://blog.scasecurity.com/understanding-the-risks-and-mitigation-of-phishing-attacks) ### Comments © 2026 - All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "SCA Editor", "url" : "https://blog.scasecurity.com/author/sca-editor" }, "dateModified" : "2025-04-10T15:59:19.983Z", "datePublished" : "2015-05-18T04:00:00.000Z", "headline" : "Medical Records Worth More Than Credit Card Info - SCA Security", "image" : [ "https://blog.scasecurity.com/hubfs/Imported_Blog_Media/Optimized-AdobeStock_635083842-1200x580.jpg" ], "mainEntityOfPage" : { "@id" : "https://blog.scasecurity.com/medical-records-worth-more-than-credit-card-info", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.scasecurity.com/hubfs/sca-logo-r.png" }, "name" : "Security Compliance Associates" } } ```