One afternoon last spring , Micky Tripathi received a panicked call from an employee . Someone had broken into his car and stolen his briefcase and company laptop along with it . So began a nightmare that cost his small nonprofit health consultancy nearly $ 300,000 in legal , private investigation , credit monitoring and media consultancy fees . Tripathis nonprofit , the Massachusetts eHealth Collaborative in Waltham , Mass. , works with doctors and hospitals to help digitize their patient records . His employees stolen laptop contained unencrypted records for 13,687 patients each record containing some combination of a patients name , Social Security number , birth date , contact information and insurance information an identity theft gold mine . His experience , which proved costly , was hardly uncommon . Large - scale medical data breaches have been on the rise in recent years . As part of the 2009 stimulus bill , the federal government provides incentive payments to doctors and hospitals to adopt electronic health records . Nearly 40 percent of U.S. primary - care doctors and about 25 percent of hospitals now use electronic patient records . An unintended consequence is that as patient records have been digitized , health data breaches have surged as hospitals adopt electronic medical records and mobile technology without spending enough on security to ensure patient privacy . The number of reported breaches was up 32 percent in 2011 from the year before , according to the Ponemon Institute , a Michigan - based information - security research group . Those breaches cost the industry an estimated $ 6.5 billion in 2010 . In 49 percent of the cases , lost or stolen phones or personal computers were responsible . Fifty - three percent of the organizations surveyed by the group said that inadequate funding was the biggest barrier to preventing data breaches . Fallout can be severe When mistakes occur , the fallout can be more severe than the typical breach of email addresses or credit card numbers . In the wrong hands , health records also can be used for blackmail and public humiliation . The information can also be used by insurance companies to inflate rates , or by employers to deny job applicants . Tripathi , of Massachusetts eHealth Collaborative , did nt find the stolen laptop , and the incident cost his nonprofit $ 288,000 not to mention 600 hours dealing with the fallout and the intangible cost of repairing the reputational damage that followed . In many ways , it got off easy . In October , a desktop computer containing unencrypted records on more than 4 million patients was stolen from Sutter Health , a nonprofit health system based in Sacramento . A rock was thrown through a window to gain access to the computer . The theft is now the subject of two class - action suits , each of which seeks $ 1,000 for each patient record breached . The stolen computer did not contain patient financial records , Social Security numbers , health plan identification numbers or actual medical records , Sutter said . Many major breaches Since federal health care data - breach notification rules took effect in 2009 , Health and Human Services records show that the Sutter theft was exceeded only when the U.S. militarys health insurance program lost backup tapes in September containing information on more than 4.9 million patients . Last year , hard drives containing health histories , financial information and Social Security numbers of 1.9 million Health Net insurance customers disappeared from an office . State regulators launched investigations into Health Nets security procedures . In one of the largest cases before implementation of notification rules , government health data was at risk in 2006 when a laptop with data on 26.5 million veterans was stolen from a government employees home . The computer equipment was recovered , and the FBI said the sensitive files were nt accessed . In another California case , Stanford Hospital in Palo Alto blamed a subcontractor used by an outside vendor for a privacy breach that led to the posting online of medical information for thousands of emergency room patients . The data of 20,000 patients , including names and diagnosis codes , remained on a commercial website for nearly a year until it was discovered in August and taken down . The spreadsheet included names , diagnosis codes , account numbers , admission and discharge dates , and billing charges for patients seen at Stanford Hospitals emergency room during a six - month period in 2009 , said Gary Migdol , a spokesman for Stanford Hospital and Clinics . It did not include Social Security numbers , birth dates , credit card numbers or other information used to perpetrate identity theft , he said , but the hospital is offering free identity protection services to affected patients . Lagging in encryption Roughly one - fifth of the publicly disclosed breaches in the last seven years have involved health care providers , according to a database kept by San Diego - based Privacy Rights Clearinghouse . The increasing digitization of medical data are creating new problems , as the information travels more easily among the dozens of contractors that are typically authorized to handle a persons medical records and is more easily lost or accidentally posted online . While Sutter said the computer was password - protected , the data on patients was not encrypted , drawing criticism from privacy and computer security experts . On a computer in which data are encrypted , a user would typically have to enter another password in addition to the computers general password to access that specific data . Though encrypting patient information is highly recommended by the federal government , Verizon health care and data security expert Dr. Peter Tippett said the health care industry lags behind the financial and high - tech industries by 10 to 15 years when it comes to protecting personal data . Overall , the health care system needs a lot of work at being more secure , Tippett said . In most cases , Tippett said , computer thieves are simply looking to make a little cash reselling the stolen computer itself . Sometimes they may try to ransom the computer back to its original owner . If the data itself is accessed , usually by organized crime operations , he said criminals would generally try to use it to blackmail prominent people with potentially embarrassing diagnoses or steal patients identities to fraudulently bill health insurers for medical procedures that were nt really performed . Cleanup complicated Cleaning up after such breaches can be difficult . Tripathi , of eHealth Collaborative , went to work assembling a crisis team of lawyers and customers and a chief security officer . The biggest headache , he says , was deciphering how much about the breach his nonprofit needed to disclose . Health organizations are required by federal law to report data breaches that affect more than 500 people to the Department of Health and Human Services . The departments Office of Civil Rights publishes the equivalent of a data breach Wall of Shame on its website which now includes 385 breaches affecting more than 18 million people . Tripathi said he quickly discovered just how many ways there were to count to 500 . The law requires disclosure only in cases that pose a significant risk of financial , reputational or other harm to the individual affected . His team spent hours poring over a backup of the stolen laptop files . Of the nearly 14,000 patient records on the stolen laptop , most records did not warrant disclosure . In 2,777 cases , for instance , a record listed only a patients name . Liability issues Complicating matters were liability rules . In the eyes of the law , Tripathis nonprofit is a contractor that acts on behalf of health providers . The legal burden of protecting patient data actually falls on his clients : the physicians and hospitals who entrusted his nonprofit with their files . The laws create a perverse outcome , he says . It was our fault , but from a federal perspective , it was nt our breach . Tripathi narrowed down the group of patients whose data put them at serious risk for identity theft to 998 people across seven physician practices . Only one practice broke the 500 - patient threshold requiring disclosure on the Department of Health and Human Services website . His office got to work notifying the affected patients of the data breach . They offered free credit monitoring though less than 10 percent took them up on the option spending a total of $ 6,000 . In the aftermath , Tripathi says his company destroyed all patient data on mobile devices and temporarily prohibited employees from removing patient data from clients offices . The company mandates that all data be encrypted , and employees are required to tell health providers what data they will need to access and how they plan to use it . Breaches are going to be one of the big challenges as more physicians and hospitals adopt electronic health records , Tripathi says . Were entering a brave new world . ;