---
title: What do you need to know if you transmit or maintain health data?
description: Healthcare data is a prime target for hackers. Organizations must follow HIPAA guidelines, close security gaps, and avoid costly fines for non-compliance.
---

[Security Blog ](https://foresite.com/blog)

# [What do you need to know if you transmit or maintain health data?](https://foresite.com/blog/need-know-transmit-maintain-health-data)

 Written by [Foresite Cybersecurity](https://foresite.com/blog/author/foresite) | March 27, 2018

Organizations that handle healthcare data need to understand the risks, requirements, and ramifications in order to make prudent decisions on how best to protect it.  Let’s start with the risks.

HIMSS published their 2018 healthcare survey and found that most healthcare organizations (over 75%) have had a significant security incident in the past 12 months.  Health data is being targeted by hackers for the value it brings on the dark web as it can be used for identity theft to open new credit accounts.  It takes far longer for an individual to determine that their identity has been stolen than it does for them to be alerted to unusual activity on a stolen credit card, so the personal information in health data is more valuable to hackers.

How do the hackers gain access to the data?  Email phishing tops the list, but compromised networks and web applications, misconfigured cloud services, and being able to figure out credentials were other common methods.

Of course [HIPAA compliance](https://foresite.com/hipaa-compliance-services/) provides a framework to secure this valuable data, so why is this still such an issue?  In many cases organizations do not understand how to properly use the HIPAA guidelines to establish the appropriate technical controls, policies and procedures, including security solutions, [threat monitoring](https://foresite.com/security-monitoring-alerting/) and [incident response](https://foresite.com/incident-response-2/). If your organization falls into this category, an assessment against the HIPAA guidelines by [a qualified assessor](https://foresite.com/certifications/) can help you identify and close gaps that could leave you vulnerable.

Willful neglect of the HIPAA compliance guidelines is another reason that organizations fail to protect health data.  This has prompted [harsher penalties](https://www.hipaajournal.com/what-are-the-penalties-for-hipaa-violations-7096/) for those found non-compliant, both after a breach or during a proactive audit by HHS.  The chart below shows the steep price paid by organizations that failed to meet compliance, and should serve as a warning to confirm your own adherence to the guidelines.

 

## 2017 HIPAA Fines

 

| **Date** | **Organization** | **Fine Total** | **Link to OCR Settlement** |
| --- | --- | --- | --- |
| January 9, 2017 | Presence Health | $475,000 | [First HIPAA enforcement action for lack of timely breach notification settles for $475,000](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/presence/index.html?language=es) |
| January 18, 2017 | MAPFRE | $2,200,000 | [HIPAA settlement demonstrates importance of implementing safeguards for ePHI](http://wayback.archive-it.org/3926/20170127111936/https://www.hhs.gov/about/news/2017/01/18/hipaa-settlement-demonstrates-importance-implementing-safeguards-ephi.html) |
| February 1, 2017 | Children’s Medical Center of Dallas | $3,200,000 | [Lack of timely action risks security and costs money](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/childrens?language=es) |
| February 16, 2017 | Memorial Healthcare Systems | $5,500,000 | [$5.5 million HIPAA settlement shines light on the importance of audit controls](https://www.hhs.gov/about/news/2017/02/16/hipaa-settlement-shines-light-on-the-importance-of-audit-controls.html) |
| April 12, 2017 | Metro Community Provider Network (MCPN) | $400,000 | [Overlooking risks leads to breach, $400,000 settlement](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/MCPN.html) |
| April 20, 2017 | The Center for Children’s Digestive Health (CCDH) | $31,000 | [No Business Associate Agreement?  $31K Mistake](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/ccdh/index.html) |
| April 24, 2017 | CardioNet | $2,500,000 | [$2.5 million settlement shows that not understanding HIPAA requirements creates risk](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/cardionet/index.html) |
| May 10, 2017 | Memorial Hermann Health System (MHHS) | $2,400,000 | [Texas health system settles potential HIPAA violations for disclosing patient information](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/MHHS/index.html) |
|  May 23, 2017 |  St. Luke’s Roosevelt Hospital System Inc. |  $387,200 | [Careless handling of HIV information jeopardizes patient’s privacy, costs entity $387k](https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/stlukes/index.html) |
|  December 18, 2017 |  21st Century Oncology |  $2,300,000 | [$2.3 Million Levied for Multiple HIPAA Violations at NY-Based Provider](https://www.sec.gov/Archives/edgar/data/1503518/000110465915086326/a15-25285_1ex10d2.htm) |
|   | ** 2017 TOTAL:** | **$19,393,200** |   |

[View full post](https://foresite.com/blog/need-know-transmit-maintain-health-data)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Foresite Cybersecurity"
  },
  "dateModified" : "2025-04-03T16:21:38.638Z",
  "datePublished" : "2018-03-27T12:00:00Z",
  "headline" : "What do you need to know if you transmit or maintain health data?",
  "image" : {
    "@type" : "ImageObject",
    "height" : 667,
    "url" : "https://44780962.fs1.hubspotusercontent-na1.net/hubfs/44780962/Imported_Blog_Media/shutterstock_324146678.jpg",
    "width" : 1000
  },
  "mainEntityOfPage" : "https://foresite.com/blog/need-know-transmit-maintain-health-data",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Security Blog"
  }
}
```