Why HIPAA Violation Statistics in Minnesota Matter to Patients in Minneapolis, Minnesota

Health privacy breaches happen far more often than most patients realize. In a single recent year, large health data breaches hit more than 240 million people across the country. That number comes from a federal report to Congress on health data breaches, which costs millions of dollars in damages and result in millions of dollars in monetary settlements, civil money penalties and other corrective actions. HIPAA violation statistics in Minnesota and the rest of the United States are troubling and increasing each year as hacking becomes more sophisticated and security measures become more lax. Each number stands for a real patient who trusted a clinic, a hospital, or a health plan to protect their health information, but it was not done. A Minnesota HIPAA violation lawyer can explain what these trends mean for your rights under state law.

Here at Kuhlman Law, we help patients after a clinic, a hospital, or a stranger exposes their private health records. Attorney Christopher Kuhlman stands up for patients across Minneapolis, Hennepin County, and the rest of the state in health record privacy claims. He tracks how these breaches happen and who tends to cause them, and seeks compensation for victims and their families for their damages caused by the negligent or intentional disclosure of protected health information. He also knows how to use the Minnesota Health Records Act to seek money for the harm you suffered including his counsel fees. His experienced and compassionate law firm looks at these cases at no cost to you, so call today for a free consultation.

Where Do HIPAA Violation Statistics Come From?

Most HIPAA violation statistics come from the federal Office for Civil Rights (known as the OCR), which most people call OCR. This office takes patient complaints and breach reports for the U.S. health department. A health care group must tell OCR about any breach that hits 500 or more people soon after it finds the problem. OCR then posts those large breaches on a public breach portal that anyone can search. Providers still report smaller breaches, but they can send those in just once a year. State agencies and local news outlets fill in the rest of the picture for patients here.

Thousands of Patients File HIPAA Complaints Every Year

HIPAA violation statistics show that patients complain about privacy problems far more often than most people think. The federal privacy office has received more than 370,000 complaints since the privacy rule took effect, based on its enforcement results. It now logs roughly 30,000 new complaints each year, says its annual compliance report. Many complaints end early because they fall outside the rules or come in too late. Even so, OCR has made health care groups fix their practices in more than 31,000 cases. It has also sent more than 2,400 cases to the Justice Department for a criminal probe.

Based on federal data, patients complain most often about problems such as these:

• Using or sharing health records in ways the law does not allow
• Weak safeguards that leave records open to the wrong people
• Delays or refusals when patients ask for copies of their own records
• Poor safeguards for electronic health records
• Sharing more health details than a task truly required, and
• Other privacy failures by hospitals, private practices, pharmacies, and health plans.

Small Breaches Happen Far More Often Than Large Ones

Big hacks grab the headlines, yet small mistakes cause most health data breaches. Providers reported more than 74,000 small breaches in one recent year, and each one hit fewer than 500 people. That same year, OCR got only about 660 reports of large breaches. Almost all of the small breaches came from snooping or from sharing records with the wrong person. That often means a letter, a fax, or a chart went to the wrong place.

HIPAA violation statistics in Minnesota also show that the source of a breach matters. Health care providers reported about three out of every four large breaches. Yet outside vendors, known as business associates, caused the breaches that hit the most patients. According to statistics cited above, those vendor breaches reached roughly 85 percent of all the people caught up in large breaches that year. In other words, your records can leak from a company that you have never even heard of.

HIPAA Violation Statistics on How Large Breaches Happen

Recent HIPAA violation statistics show that hacking now drives most large health data breaches. About four out of five large breaches came from hacking or other IT attacks in one recent year. Those hacks made up nearly all of the patient records that large breaches put at risk. Our page on hackers and data miners explains how patients in this state can respond after criminals steal their records.

Network servers held the data in most of these attacks, so one hack can expose a huge number of records. Email played a role in roughly one in four large breaches. That is why medical records sent to a work email can create such serious risks. Federal breach reports sort the causes of large breaches into a few main groups, which include these:

• Hacking and ransomware attacks on networks
• Unauthorized access or sharing by employees or others
• Theft of laptops, paper files, and portable devices
• Improper disposal of paper records or old equipment, and
• Loss of devices or files that held patient records.

Minnesota HIPAA Violation Statistics at a Glance

Local HIPAA violation statistics show that patients in this state have felt these breaches up close. Groups based in Minnesota reported almost 20 large breaches in one recent year, based on a review of federal breach data. Those breaches hit more than 220,000 people in just Minnesota, too, which is very troubling. 

The largest health data breach in U.S. history also has deep local roots. Change Healthcare is part of UnitedHealth Group, which has its home base in Eden Prairie. A cyberattack on Change hit about 193 million people, according to federal health officials. Eden Prairie sits just southwest of Minneapolis in Hennepin County, making Minnesota and its residents a very real target for protected health information violations.

Notable Health Data Breaches Affecting Minneapolis, Minnesota Patients

The HIPAA violation statistics in this state come from many kinds of breaches. Hackers, vendors, and nosy employees all play a part. Some breaches involve hundreds of thousands of people, while others touch only a handful. Each one can still cause real harm for the patient whose private details got out. Our page on coworkers explains how snooping at work can lead to a privacy claim.

Some of the notable breaches that hit patients here include the following:

• A user tied to a licensed provider who viewed far more MnCHOICES data than the job required, which affected about 304,000 people served by the Minnesota Department of Human Services
• A cyberattack on an Edina radiology group that exposed records for more than 580,000 patients
• An audit that led Allina to fire more than 30 hospital workers in Fridley and Coon Rapids for viewing overdose patients’ charts without a work reason
• Tracking tools on hospital websites that allegedly sent patient browsing data to outside tech companies, and
• Many smaller breaches that never reach the news or the public federal portal.

Why HIPAA Violation Statistics Rarely Mean Money for Patients

Federal fines sound large, but they almost never reach the patient. HIPAA violation statistics show that OCR has settled cases or issued fines about 150 times since the privacy rule began. Those actions total roughly $145 million which is a staggering figure. Under federal penalty rules, a single violation can cost more than $70,000 too, making the multiple million of victim cases significant. Yearly fines for the same type of violation can top $2 million easily.

Yet that money goes to the government, not to you. Congress told officials to find a way to share some of these fines with harmed patients. The agency asked the public for input on that plan, but there is still no system that pays patients. HIPAA also gives patients no private right to sue. That is why a Minnesota HIPAA violation lawyer looks to state law instead. We explain this gap in our post on who prosecutes a Minnesota HIPAA case.

How the MHRA Helps Minnesota Patients Recover Damages

State law fills the gap that HIPAA leaves behind. The Minnesota Health Records Act, or MHRA, lets patients sue when someone wrongly releases or looks at their health records. Official HIPAA violation statistics do not track MHRA verdicts or settlements, and many of these claims settle in private. Still, recent cases show that the law has real teeth. Allina Health agreed to pay about $12.5 million to settle a class action over website tracking tools, though it denied any wrongdoing. That case included claims under the MHRA, along with several other privacy laws.

Our post on how to sue a Minnesota hospital for a HIPAA violation covers these claims in more detail. Under the state remedy statute, a violation can lead to results such as these:

• Compensatory damages caused by an unauthorized release of a health record
• Compensatory damages caused by intentional, unauthorized access to a record
• The costs of bringing the claim
• Reasonable attorney fees, and
• Possible discipline from the board that licenses the provider.

Turning HIPAA Violation Statistics Into Action

HIPAA violation statistics show that breaches are common, but your claim depends on your own facts. A snooping coworker, a misdirected email, and a massive hack each call for different proof. Save every breach notice, email, or message that you get, and write down who saw your records. Also note the date when you first found out about the breach. A Minnesota HIPAA violation lawyer can then gather audit logs and other proof before it disappears. Our post on whether you need a lawyer for a Minnesota HIPAA violation explains when legal help makes sense.

Do Not Let HIPAA Violation Statistics Define Your Case in Minneapolis, Minnesota

Health privacy breaches strike patients in this state every year, and the harm can last long after the news fades. Federal law may not let you sue, but the Minnesota Health Records Act does. That law allows compensatory damages, the costs of the claim, and reasonable attorney fees.

At Kuhlman Law, Christopher Kuhlman stands up for patients across Minneapolis, Hennepin County, and the rest of Minnesota. He offers a free consultation and seeks compensation for you under the MHRA. Do not let your story become just one more line in the HIPAA violation statistics. Call a Minnesota HIPAA violation lawyer at our office today at 612-444-3374. You can also review our health record privacy practice areas to learn more.