An Analysis of HIPAA Breach Data

As software developers, we have a responsibility to protect our user’s data. When this data is protected health information (PHI), breaches can have serious financial and reputational consequences. The goal of this research is to analyze trends in breaches of PHI that point to software design guidelines that can prevent or lessen the impact of breaches. We examine the US Office of Civil Rights public data on HIPAA breach notifications and examine some of its implications for software system design We observe that a significant number of breaches involve the use of portable stores of unencrypted records and present software design strategies to address these breaches before they happen.