Healthcare organizations need a data breach response plan

by Experian Health 5 min read June 25, 2021

Healthcare data breaches are nothing new, but their size and frequency are increasing:

  • CVS Health lost over a billion search records when a third party accidentally made an online database publicly accessible in March 2021.
  • A ransomware data breach at prescription management vendor CaptureRx affected over a million patients at 17 healthcare providers in February 2021.
  • More than 3.47 million individuals and at least 10 healthcare organizations were affected by a massive data breach at file transfer company Accellion, which spanned multiple global industries in December 2020.

Further illustrating the risks to healthcare organizations, Scripps Health in San Diego was hit with two class-action lawsuits that assert that the organization should have done more to protect patient data. If upheld, it will set a precedent for healthcare organizations to be held legally responsible for failing to protect data – to the tune of $1000 per patient. The direct monetary cost of fines and lawsuits, however, may ultimately be a secondary concern as damaged reputation is often a more difficult setback to overcome. Patients increasingly approach healthcare as “consumers” and a breach – or a poorly managed breach situation – might prompt them to look elsewhere for care.

“Incidents happen every day. However, the real threat lies in how quickly and efficiently an organization can respond. This is what customers will remember. You need to be able to make prompt updates to your website, scale up call center capacity, and have answers ready when consumers need them.”

The growing frequency and scale of health information breaches means it’s no longer sufficient to say, “we’re careful with our health data – this won’t happen to us.” Medical identities are extremely valuable, which makes them an attractive target to cybercriminals. In addition, the sudden increase in virtual care and remote working during the pandemic has created new vulnerabilities in data security.

A recent FBI alert that a major ransomware group is targeting the healthcare sector with phishing attacks is a cl reminder that healthcare organizations can’t relax when it comes to cybersecurity. It’s a case of “when, not if” a healthcare organization will have to deal with a breach. Prevention is the goal, but preparation is the smart strategy.

Shifting from data breach prevention to preparedness

During the pandemic, the volume of data being shared within and between healthcare organizations sky-rocketed, as providers offered more virtual care services and workforces became more distributed. While these innovations meant access to healthcare and work could continue safely, the shift to cloud-based data sharing and storage, means the data perimeter is much broader and tougher to secure – if there remains a perimeter at all. Data must be secured at the device- and employee-level now.

While prevention is better than cure, the hard truth for healthcare cybersecurity teams is that they’re increasingly likely to have to deal with a breach. Unfortunately, many organizations don’t have the technology, resources, or time to prevent breaches all the time, at every access point.

Chris Wild, vice president at Experian Health, says:

“We’re seeing an increased frequency of cyber threats across the whole industry. Hardly a week goes by that we don’t hear of a health system under attack from hackers or ransomware. The statistics show us there’s a health data breach nearly every single day, so it’s just a matter of time before it impacts any one provider, pharmacy, payer or physician group.”

Instead of focusing solely on prevention, healthcare organizations need a strategy to prepare for what happens when a breach occurs. If they don’t, they risk a long, public struggle to contain the breach, resulting in brand damage, patient loss, and financial consequences in the form of fines and lost revenue.

Building a data breach response plan

Recovering from a data breach requires a speedy and thorough response. With a plan in place, action can be taken as soon as the dreaded call comes in. Knowing exactly what needs to be done to meet HIPAA notification requirements, helps reassure consumers and regulators alike that every effort is being made to contain the breach. Not only will this help minimize fines, but it will also mitigate against the reputational damage caused by the security breach.

A breach is bad enough but compounding the negative impact of exposed data by failing to provide sufficient support to worried consumers is even worse. Wild says: “Incidents happen every day. However, the real threat lies in how quickly and efficiently an organization can respond. This is what customers will remember. You need to be able to make prompt updates to your website, scale up call center capacity, and have answers ready when consumers need them.”

A robust response plan calls for C-suite engagement, clear success metrics, and regular pressure-testing. Above all, it must be flexible to adapt to whatever size and type of breach occurs.

The best support for the worst-case scenario

A data breach response plan isn’t going to prevent the breach itself, but it can help a healthcare organization take the right steps in the aftermath. Having serviced thousands of data breaches over the last 17 years, Experian Health’s Reserved Response™ program is based on real world experience and has evolved as the threats and consequences have increased. In a recent survey, clients using Reserved Response reported 15% fewer data security incidents than those who did not. Furthermore, any incidents that did occur tended to be smaller in scale.

Because the risk and impact of data breaches is trending upwards, this year Experian Health has introduced a new Reserved Response Hub. This digital, self-service tool helps to prepare and test a data breach plan, including:

  • the new and improved 2021 Data Breach Response Guide
  • downloadable readiness reading materials
  • tried and tested notification templates
  • a pre-breach incident checklist
  • access to Experian’s full Reserved Response service, which provides support before or after a breach to ensure regulatory compliance and support for those impacted.

Reserved Response can help healthcare organizations put together a data breach preparedness plan in as little as three days.

Related Posts

Andy’s New WP Workflow Test Article Using Quick Edit

Key takeaways: Revenue cycle teams can use automation to reduce repetitive work and apply AI where data-driven prediction, matching or prioritization can improve a workflow. Experian Health’s 2025 State of Claims survey found that 41% of providers now face denial rates of 10% or higher, while 68% say submitting clean claims is more challenging than a year ago. Patient Access Curator™ (PAC) uses AI to support front-end data validation and insurance discovery, while AI Advantage™ helps teams predict denial risk and prioritize denial follow-up. Artificial intelligence (AI) and automation can support administrative work in healthcare. In the revenue cycle, teams depend on accurate information, timely decisions and efficient follow-up to keep claims moving. In revenue cycle management, AI and automation can help organizations reduce manual checks, find data gaps, predict denial risk and prioritize work queues. These tools are most useful when they support staff judgment, payer expertise and compliance oversight. They can handle repetitive, data-heavy tasks so staff can focus on exceptions and decisions that need human review. In 2023, McKinsey & Company reported that research suggests effectively deploying automation and analytics could eliminate $200 billion to $360 billion of spending in U.S. healthcare. For revenue cycle leaders, the practical question is where to apply those capabilities first. The case for applying AI and automation in healthcare Revenue cycle teams juggle many daily tasks. Staff collect and verify patient information, confirm eligibility, identify the right payer, submit clean claims, monitor status, work denials and manage collections. Small data gaps at the beginning of the process can create downstream rework and delays. Rework also consumes staff time, adding to these operational pressures. As costs rise and revenue cycles tighten, there is increasing pressure to do more with less. Experian Health’s 2025 State of Claims survey found that 54% of providers say claim errors are increasing and 90% of claim denials are reworked with at least some human review before resubmission. Providers are also managing broader financial and administrative pressures. The American Hospital Association has reported that prior authorization requirements, claim audits, denials and other payer policies add administrative burden and cost for hospitals and health systems. These requirements also consume staff time to appeal denials and manage payer processes. AI and automation are different but complementary. Automation follows defined rules to complete repeatable work. AI models can identify patterns in data, predict risk and help teams decide where to focus attention. When used together, they can support more consistent revenue cycle workflows. How AI and automation can support revenue cycle workflows Revenue cycle management automation and AI are most useful when tied to a specific workflow and a measurable operational problem. The goal is to help teams act earlier, reduce avoidable rework and focus staff time where judgment is needed most. For example, automation can complete rule-based eligibility checks. AI can help identify claims with a higher likelihood of denial. In insurance discovery workflows, AI can also help identify coverage that wasn’t captured at registration. When these tools fit into existing workflows, they can support more consistent decisions and reduce manual work. Three practical applications include: 1. Improving front-end data quality with Patient Access Curator Patient and coverage information collected early in the revenue cycle can affect downstream claim outcomes. Incomplete or outdated demographic details, eligibility responses, coordination of benefits or Medicare Beneficiary Identifier information can create problems that lead to claim delays or denials later in the cycle. Experian Health’s Patient Access Curator helps prevent claim denials by validating demographics, eligibility, insurance discovery, coordination of benefits and Medicare Beneficiary Identifier data in seconds. PAC’s AI and machine learning capabilities help improve match accuracy, coverage sequencing and data confidence by writing the validated data back into the host system and sequencing payers before the claim is created. This automates work that would otherwise require manual coverage checks. 2. Using insurance discovery to find coverage not captured at registration When active coverage isn’t identified during registration, claims may be delayed or submitted with incomplete insurance information. Insurance discovery looks for coverage that may not have been captured during registration. Patient Access Curator includes insurance discovery as part of its front-end validation workflow. It can help identify and correct missing or incorrect insurance information so claims can be submitted with more complete coverage data. 3. Using AI to prevent and prioritize denials Even with strong front-end processes, some claims still require additional attention. AI can help claims teams decide which claims to review before submission and which denials to work first after payer response. Experian Health’s AI Advantage supports two denial management use cases:1. AI Advantage – Predictive Denials uses a client’s historical claims data and Experian’s knowledge of payer rules to identify claims with a high likelihood of denial before submission so teams can take corrective action.2. AI Advantage – Denial Triage uses AI to segment denials and identify those with the highest potential for reimbursement. This approach can help teams prioritize with more confidence. Rather than treating every claim or denial the same way, teams can use predictive models to focus on the work that needs the most attention. Potential benefits of AI and automation in the revenue cycle A high-performing revenue cycle depends on timely, accurate and consistent work. AI and automation can help providers modernize that work without losing the expertise of the people who manage complex payer and patient situations every day. When applied to the right workflows, these tools can help organizations: Reduce manual data searches that take staff away from higher-value work Improve front-end data quality before claims are created Identify missing or incorrect coverage information earlier Spot claims that may be at higher risk of denial Prioritize denied claims by potential reimbursement Reduce rework caused by inaccurate or incomplete information Give staff more consistent information for follow-up decisions A focused AI strategy starts with the workflow problem, uses data that is relevant to that problem and keeps staff in control of judgment-based decisions. A more proactive approach to revenue cycle management Revenue cycle teams can move from reactive work toward a more proactive approach: catch errors earlier, validate coverage before claims are created and prioritize the claims and denials that need the most attention. Experian Health offers revenue cycle solutions that use AI and automation in targeted ways to support front-end data quality, reduce rework and manage denials. Patient Access Curator supports registration and coverage validation, while AI Advantage supports denial prediction and triage. Learn more about Experian Health’s Patient Access Curator and AI Advantage.

October 2, 2026 by Andy.Monte@experian.com
Experian Health ranked #1 in Best in KLAS for 2025

Experian Health is very pleased to announce that we've ranked #1 in the 2025 Best in KLAS: Software & Services report, for our Contract Manager and Contract Analysis product, for the third consecutive year. Contract Manager, when paired with Contract Analysis, empowers healthcare providers by ensuring payers comply with contract terms, identifying and recovering underpayments, and arming them with real claims data to negotiate contracts. This enables providers to negotiate more favorable terms and maintain financial stability.  Clarissa Riggins, Chief Product Officer at Experian Health, says, “In the ever-evolving healthcare landscape, our Contract Manager solution has once again been recognized as the #1 Revenue Cycle Management tool by KLAS for the third consecutive year. This prestigious ranking underscores the significant value our solution delivers to our clients by identifying underpayments and facilitating revenue recovery. We are honored to continue supporting our clients with innovative solutions that drive financial success and operational efficiency.”  Learn more about how Contract Manager and Contract Analysis can help your healthcare organization validate reimbursement accuracy, recover underpayments and boost revenue.   Learn more Contact us

February 5, 2025 by kelly.nguyen
How to increase patient engagement

Learn how providers can increase patient engagement, why it matters and key strategies that deliver improved end-to-end patient experiences.

January 30, 2025 by Experian Health

Spotlight test

Spotlight Description

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Sticky Subscribe Title

Sticky Subscribe Description
Sticky Subscribe

Testing Spotlight Paragraph block

Testing the spotlight block header

Archive Testing

Categories