Tampa General Hospital is one of the largest hospitals both in the Tampa Bay area and the state of Florida. Because of the sheer volume of patients seen at Tampa General Hospital, the information subject to a data breach is significant. A serious data breach occurred in May of 2023, but it is the response of the hospital to this breach that makes this situation a warning to all businesses who manage sensitive personal data.
A Class Action Lawsuit Was Filed Against Tampa General Hospital
A class action lawsuit was filed in early August against Tampa General Hospital. This suit was the result of a data breach that included over one million people having their data stolen. The information included names, addresses, phone numbers, dates of birth, Social Security numbers, health information, medical records, patient account numbers, and other personal information. Three unidentified plaintiffs, one acting on behalf of her deceased mother, have filed the suit on behalf of all the victims.
Why is this Data Breach So Serious?
All healthcare providers are at risk of data breaches because their information is so valuable to cyber criminals. It’s important to note that not every data breach in a healthcare facility reaches this critical point. This data breach is serious because Tampa General Hospital not only failed to safeguard their data, but also failed to notify the victims who had their information at risk until two months after the breach, and in fact, did nothing at all about the intrusion until over two weeks had passed.
The hospital acknowledged the detection of unusual activity on May 31. However, upon further investigation, it was discovered that this unusual activity had initially been observed on May 12, yet no action was taken at that time. During the period between recognizing the breach and notifying the affected individuals, the hospital failed to implement protective measures, leaving individuals vulnerable. As a result, at least one person had their identity stolen before any safeguarding measures were put in place.
Not only was the scale of the breach significant, but it was found that Tampa General Hospital was aware that their current cybersecurity measures were inadequate and appeared to have a very cavalier attitude toward data security and patient privacy.
The Importance of Compliance with FTC and HIPAA
The significance of this breach lies in Tampa General Hospital’s non-compliance with both the FTC and HIPAA regulations by failing to adhere to the recommended patient security measures outlined by these regulations. The hospital is accused of several serious charges, including violating the Florida Deceptive and Unfair Trade Practices Act, negligence, breach of express contract, breach of implied contract, invasion of privacy, unjust enrichment, breach of confidence, and breach of fiduciary duty. By ignoring the regulatory requirements, when the inevitable breach happened, the fallout was severe. Not only is Tampa General Hospital facing a class action lawsuit, but inevitable fines from the FTC as well.
How Could Tampa General Hospital Have Prevented this Incident?
Tampa General Hospital never implemented adequate security safeguards to protect patient information and dedicated only 15% of the IT budget to security, whereas industry standards for healthcare facilities is 20% or higher. Some of the most basic requirements weren’t met, such as training employees on data security, developing policies to prevent data breaches based on industry standards, enforcement of those policies, and developing a data breach response plan. To prevent a breach from happening to this scale, there are preventative steps as well as a response plan that could have minimized the impact.
Through their actions, or rather, their inaction, Tampa General Hospital seems to prioritize cybersecurity far less than they have conveyed to their patients during the intake process. Despite experiencing a data security incident nearly a decade ago, Tampa General Hospital was aware of the need to enhance their safeguards but failed to implement sufficient measures to address the issue.
How Can Healthcare Facilities Prevent Serious Data Breaches?
Healthcare facilities need to first understand their risk of a data breach may be higher than other industries. Although all industries and facilities are at risk, large healthcare facilities are known for having a wealth of information that is highly valuable to cyber criminals. Understanding this risk, healthcare facilities must take a proactive approach by investing in cybersecurity best practices, implementing continuous threat monitoring, and establishing a strong data breach response plan. Moreover, all personnel with access to patient information should undergo regular training in these best practices and be well-versed in identifying potential data breaches.
What are the Most Important Steps to Take After a Data Breach?
After a data breach, all businesses need to make sure they are in compliance with the FTC and have a data breach response plan. This should include identifying the information that was compromised, taking the steps to lock down further access, and notifying the potential victims as soon as the breach is contained so they can take the necessary steps to safeguard themselves.
Tampa General Hospital’s lawsuit is an example of how several mistakes and mishandlings of a data breach situation can snowball into a significant issue. Had Tampa General Hospital taken the steps in the years leading up to the breach to improve their cybersecurity plan, they may have been ready for this most recent attack. Had they identified the attack immediately, steps could have been taken to minimize the impact. Had they notified the patients in a timely manner, the victims could have had the opportunity to protect themselves. By making mistakes at every stage, Tampa General Hospital is now facing a significant lawsuit. Businesses looking to protect themselves from a similar fate should make sure that their cybersecurity best practices and data breach response plans are always ready for the risk.
The financial consequences of a data breach can be substantial and are contingent upon various factors, such as the scale of the incident, the nature of the compromised data, the industry’s regulatory landscape, and the organization’s response to the breach.
A comprehensive understanding of these variables empowers organizations to proactively shield themselves from the fiscal and reputational hazards associated with data breaches. This proactive approach involves the implementation of robust security protocols, educating employees on the identification and prevention of data breaches, and establishing a well-defined incident response plan.
At AccuShred, we are deeply committed to assisting businesses with safeguarding their valuable data because we recognize the stakes involved. As your dependable and trusted data security partner, we also offer support in evaluating your current cybersecurity measures. Conducting a self-assessment using CSR Readiness Pro can effectively mitigate the risks and consequences of a data breach, ensuring the security of your company’s data. Don’t hesitate to reach out to us today to discover more about how we can assist you.