Advances in healthcare security since the Anthem data breach

The data breach of healthcare giant Anthem, which came to light a little more than four years ago, exposed about 79 million patient records. It was the biggest single compromise of healthcare data in history.

It still is—which is good news regarding the security of patient data held by healthcare organizations. No single breach since then has been worse. The Anthem data breach pushed the total number of records exposed in 2015 to 112 million, and no year since then has seen anything close. However, the number of breaches has increased, from the 250 range to more than 350 most years. So it would be hard to label Anthem a wake-up call that changed the world of healthcare data security.

What’s happened since then?

As recently as last fall, Anthem has said it has found no evidence of identity theft stemming from the attack.

And an investigation by the California Department of Insurance concluded that Anthem took “reasonable measures” to protect its data before the data breach and had employed a remediation plan to respond to the breach.

“The team noted Anthem’s exploitable vulnerabilities, worked with Anthem to develop a plan to address those vulnerabilities, and conducted a penetration test exercise to validate the strength of Anthem’s corrective measures,” the department said in its statement. “As a result, the team found Anthem’s improvements to its cybersecurity protocols and planned improvements were reasonable.”

But the OCR’s investigation found differently. That investigation concluding that Anthem had failed to perform a number of security activities, including these:

• Conduct an enterprise-wide risk analysis.
• Enact sufficient procedures to review information system activity regularly.
• Identify and respond to suspected or known security incidents.
• Implement adequate minimum access controls to prevent cyber attackers from accessing sensitive patient data.

“Unfortunately, Anthem failed to implement appropriate measures for detecting hackers who had gained access to their system to harvest passwords and steal people’s private information,” said OCR Director Roger Severino.

How was Anthem affected?

$260 million seems like a staggering sum of money. But in the world of big business, everything is relative. Overall, the breach hasn’t put much of a dent in Anthem’s bottom line.

For the 2017 fiscal year, the company reported revenue of more than $90 billion (up 6.1% from the previous year), earnings of $3.84 billion (up more than 55% from $2.47 billion the previous year), and a market capitalization in October 2018 of $69.1 billion.

So while $260 million is 6.7% of Anthem’s 2017 earnings, it is well below a half percent of the company’s annual revenue or value—barely a rounding error.

Also, the company reportedly had multiple levels of cyber insurance, with coverage estimated at $150 million to $200 million. So its net losses could be less than its employee travel budget.

Even with the hundreds of millions in costs and settlements, Anthem has not admitted to any liability.