HHS Office for Civil Rights (OCR) reported 725 healthcare data breaches in 2024 affecting 275 million patient records — the highest number ever recorded in a single year. The average cost of a healthcare breach reached $10.22 million in 2025 (IBM Cost of a Data Breach Report), driven by HIPAA civil monetary penalties, legal costs, patient notification, credit monitoring, and reputational damage.
For US healthcare covered entities and business associates, 2025 represents a pivotal compliance year: the proposed HIPAA Security Rule update (March 2025) would create the most significant HIPAA technical requirements since the original Security Rule was finalized in 2003.
725 Breaches: What Went Wrong in 2024
The OCR breach portal data reveals the categories of failure driving 2024's record breach volume:
Hacking/IT incidents: 74% of reported breaches — the dominant category. Network server compromises, ransomware, and business email compromise account for the majority. The shift is structural: attackers have moved from individual workstation targeting to network-level attacks that compromise entire EHR systems, extracting millions of records simultaneously.
Unauthorized access/disclosure: 18% of breaches. Includes insider threats, misconfigured access controls exposing patient data to unauthorized staff, and accidental disclosure to wrong recipients.
Third-party/business associate incidents: Increasingly significant — 35% of 2024 breaches originated at business associates rather than covered entities. Change Healthcare (UnitedHealth Group subsidiary) alone affected 190+ million patients — the largest US health data breach in history.
Theft/loss of portable media: 8% of breaches. Laptops, USB drives, and paper records stolen or lost without encryption protection.
The 18 PHI Identifiers: HIPAA Safe Harbor Standard
HIPAA's Safe Harbor de-identification method (45 CFR §164.514(b)) requires removal of all 18 specified PHI identifiers. Most covered entities and business associates are familiar with the list conceptually, but the detection challenge is technical:
- Names: All names of patients, family members, employers
- Geographic data: All subdivisions smaller than state (street address, city, county, precinct, ZIP code first 3 digits if <20,000 population)
- Dates: All dates directly related to the patient (birth, admission, discharge, death) other than year
- Phone numbers: All telephone numbers
- Fax numbers: All fax numbers
- Email addresses: All email addresses
- Social security numbers: All SSNs
- Medical record numbers: All MRN formats (vary by EHR system)
- Health plan beneficiary numbers: All insurance member IDs
- Account numbers: All financial account numbers
- Certificate/license numbers: Medical license, DEA registration, state license numbers
- Vehicle identifiers: VINs, license plate numbers
- Device identifiers: Serial numbers, unique device identifiers
- Web URLs: All web addresses
- IP addresses: All IP addresses
- Biometric identifiers: Finger and voice prints
- Full-face photographs and comparable images
- Any other unique identifying number, code, or characteristic
The 18th identifier — "any other unique identifying number" — is the most challenging detection requirement. It means that any database-specific identifier that could link records back to a specific patient must be detected and removed, even if it does not match a predefined pattern.
Proposed HIPAA Security Rule Update: What Changes in 2025-2026
The proposed HIPAA Security Rule update published March 2025 would require:
Annual encryption audits: Covered entities must conduct annual technical audits verifying that all PHI at rest is encrypted with AES-256 or equivalent, and that encryption key management meets documented standards.
Documented de-identification procedures: For any PHI used in research, quality improvement, AI training, or analytics, covered entities must maintain documented procedures demonstrating how de-identification is achieved — not just a policy statement, but technical documentation with validation evidence.
Business associate security requirements: Business associates must now meet specific technical security requirements (previously delegated to business associate agreements without technical specification). BA technical assessments become mandatory before onboarding.
Multi-factor authentication: All workforce members with electronic PHI access must use MFA. No exceptions for "legacy systems" — the proposed rule requires MFA regardless of system age.
Incident response testing: Annual tabletop exercises and technical testing of incident response procedures. Evidence of testing must be retained.
The Change Healthcare Lesson
The Change Healthcare breach (February 2024) — affecting 190+ million Americans — illustrated the systemic risk of healthcare's interconnected infrastructure. Change Healthcare processed 15 billion healthcare transactions annually as a clearinghouse between providers, payers, and pharmacies.
The breach began with a Citrix remote access credential without MFA protection. Once inside, attackers moved laterally across Change Healthcare's network for 9 days before deploying ransomware.
The systemic lesson: any business associate with network access to healthcare transaction data represents a systemic risk to the entire healthcare ecosystem it connects. HIPAA's business associate framework was not designed for systemic infrastructure providers with access to a third of all US healthcare transactions.
For covered entities and business associates: the Change Healthcare breach directly informed the proposed HIPAA Security Rule's requirements for network segmentation, MFA, and business associate technical assessments.
Sources: