The Biggest HIPAA Breaches of 2021 So Far

In the month of September 2021 alone, the Department of Health and Human Services (HHS) received 40 reports of data breaches within the healthcare industry.

That’s a total of 1,206,799 people in the United States with compromised protected health information (PHI)...in just one month.

If that doesn’t sound like much, take note that the list of reports only includes data breaches that affect 500 or more individuals — you can imagine how long the list would be if they included incidents that affected fewer than 500 people.

The 2021 Identity Breach Report by Constella found a 51% increase in data breaches and leakages in the healthcare industry compared to 2019. Cybersecurity experts attribute this upswing to the COVID-19 pandemic. 

According to Constella CEO Kailash Ambwani, "The COVID-19 pandemic has shown us the fragility of our online infrastructure. As people continue to rely on digital solutions and working from home, both companies and individuals must take new precautions to protect themselves from potential threat actors."

The HIPAA Wall of Shame

Data breaches in the healthcare industry translate to one thing: HIPAA violations.

The HHS’s Office of Civil Rights takes every HIPAA breach very seriously — so seriously that it posts an updated list of breaches of unsecured PHI on the web. The list has an unwelcome moniker in the healthcare compliance industry: The HIPAA Wall of Shame.

We’ve looked into the HIPAA Wall of Shame, and the list was alarmingly long. For the year 2021, here are the top five biggest data breaches among healthcare organizations so far, based on the number of individuals they affected.

Florida Healthy Kids Corporation

Individuals Affected: 3,500,000

Type of Breach: Hacking/IT Incident

The Florida Healthy Kids Corporation kicked off 2021 with not just the largest breach of the year, but the largest one ever reported.

On January 29, the Florida-based health insurer reported that a breach had occurred at Jelly Bean Communications Design, the company that hosted its website as well as the Florida KidCare app.

Investigation reports show that hackers exploited long-existing vulnerabilities in the platform to gain access to a portion of the Florida KidCare application, compromising the PHI of up to 3.5 million people.

The hackers then altered the addresses of thousands of applicants and enrollees. However, they also potentially accessed other data such as:

• Names
• Dates of birth
• Telephone numbers
• Email addresses
• Social Security numbers
• Financial information
• Secondary insurance information

Forefront Dermatology, S.C.

Individuals Affected: 2,413,553

Type of Breach: Hacking/IT Incident

In June 2021, Wisconsin-based Forefront Dermatology, S.C. detected a major breach. Its investigation shows that unauthorized parties were able to gain access to its IT system and were able to access files that contained the personal data and PHI of employees, current patients, and former patients. The breach appears to have taken place between May 28 and June 4. 

The information potentially accessed by the unauthorized parties were:

• Patient names
• Addresses
• Dates of birth
• Patient account numbers
• Health insurance plan member ID numbers
• Medical record numbers
• Dates of service
• Accession numbers
• Provider names
• Medical and clinical treatment information

So far, there is no evidence that the individuals’ Social Security numbers, driver's license numbers, or financial account information were involved.

The Kroger Company

Individuals Affected: 1,474,284

Type of Breach: Hacking/IT Incident

Kroger may look out of place on this list, but the Cincinnati-based grocery chain actually operates 2,254 pharmacies and 224 medical clinics all over the United States.

In January 2021, Kroger was notified that an unauthorized party had gained access to Accellion — the software company Kroger used to securely transfer files — by exploiting a vulnerability in the service. 

Though the incident did not affect Kroger’s own IT systems and grocery store systems, it impacted HR data, pharmacy customer information, and clinic patient information because these were the files that Kroger transferred using the Accellion software. The breached information included:

• Patient names
• Addresses
• Telephone numbers
• Dates of birth
• Social Security numbers
• Insurance claim information
• Prescription information
• Some medical history information

According to Kroger’s investigation, the incident did not impact customer passwords, credit or debit card information, and digital wallet information.