Healthcare Data Breaches: Implications for Digital Forensic Readiness

  • Maxim ChernyshevEmail author
  • Sherali Zeadally
  • Zubair Baig
Systems-Level Quality Improvement
Part of the following topical collections:
  1. Systems-Level Quality Improvement


While the healthcare industry is undergoing disruptive digital transformation, data breaches involving health information are not usually the result of integration of new technologies. Based on published industry reports, fundamental security safeguards are still considered to be lacking with many documented data breaches occurring as the result of device and equipment theft, human error, hacking, ransomware attacks and misuse. Health information is considered to be one of the most attractive targets for cybercriminals due to its inherent sensitivity, but digital investigations of incidents involving health information are often constrained by the lack of the necessary infrastructure forensic readiness. Following the analysis of healthcare data breach causes and threats, we describe the associated digital forensic readiness challenges in the context of the most significant incident causes. With specific focus on privilege misuse, we present a conceptual architecture for forensic audit logging to assist with capture of the relevant digital artefacts in support of possible future digital investigations.


Computer crime Forensics Health information management Security Threat 



We thank the anonymous reviewers for their valuable comments which helped us to improve the organization and content of this paper.

Compliance with Ethical Standards

Conflict of interest

The authors declare that they have no conflict of interest.

Ethical approval.

This article does not contain any studies with human participants or animals performed by any of the authors.


  1. 1.
    Cresswell, K. M., and Sheikh, A., Health information technology in hospitals: current issues and future trends. Future Hospital Journal 2(1):50–56, 2015.Google Scholar
  2. 2.
    Bhavnani, S. P., Parakh, K., Atreja, A., Druz, R., Graham, G. N., Hayek, S. S., Krumholz, H. M., Maddox, T. M., Majmudar, M. D., Rumsfeld, J. S., and Shah, B. R., 2017 Roadmap for Innovation—ACC Health Policy Statement on Healthcare Transformation in the Era of Digital Health, Big Data, and Precision Health: A Report of the American College of Cardiology Task Force on Health Policy Statements and Systems of Care. Journal of the American College of Cardiology 70(21):2696–2718, 2017. Scholar
  3. 3.
    Trustwave, The value of data: a cheap commodity or a priceless asset, 2017.Google Scholar
  4. 4.
    Islam, S. R., Kwak, D., Kabir, M. H., Hossain, M., and Kwak, K.-S., The internet of things for health care: a comprehensive survey. IEEE Access 3:678–708, 2015.CrossRefGoogle Scholar
  5. 5.
    Verizon, Protected health information data breach report, 2018.Google Scholar
  6. 6.
    U.S. Department of Health & Human Services (HHS), The HIPAA privacy rule. Accessed 8 April 2018.
  7. 7.
    Information Commissioner’s Office (ICO), Data Protection Bill 2017. Accessed 8 April 2018.
  8. 8.
    European Union (EU), Home Page of EU GDPR. Accessed 8 April 2018.
  9. 9.
    Office of the Australian Information Commissioner (OAIC), Privacy Act. Accessed 8 April 2018.
  10. 10.
    Office of the Australian Information Commissioner (OAIC), Notifiable data breaches scheme. Accessed 8 April 2018.
  11. 11.
    Singapore Personal Data Protection Commission, Personal data protection act overview. Accessed 8 April 2018.
  12. 12.
    Office of the Privacy Commissioner of Canada, The Personal information protection and electronic documents act (PIPEDA). Accessed 8 April 2018.
  13. 13.
    Japan Personal Information Protection Commission. Act on the Protection of Personal Information Act No. 57 of (2003), 2005.Google Scholar
  14. 14.
    U.S. Department of Health & Human Services (HHS). Breach Portal: notice to the secretary of HHS breach of unsecured protected health information. Accessed 7 April 2018.
  15. 15.
    Blum, B. I., Orthner, H. F., Implementing health care information systems. In: Implementing Health Care Information Systems. Springer, pp 3–21, 1989.Google Scholar
  16. 16.
    Medical Identity Fraud Alliance (MIFA), The growing threat of medical identity fraud: a call to action, 2013.Google Scholar
  17. 17.
    Czeschik C (2018) Black Market Value of Patient Data. In: Claudia Linnhoff-Popien RS, Michael Zaddach (ed) Digital Marketplaces Unleashed. Springer-Verlag. 10.1007/978-3-662-49275-8_78Google Scholar
  18. 18.
    Dissent, D., 655,000 patient records for sale on the dark net after hacking victims refuse extortion demands. The Daily Dot. Accessed 21 April 2018.
  19. 19.
    Bitglass, Healthcare breach report 2018: Security Procedures Thwart Attacks, 2018.Google Scholar
  20. 20.
    Moffit, R. E., Health care data breaches: a changing landscape, 2017.Google Scholar
  21. 21.
    Office of the Australian Information Commissioner (OAIC), Notifiable Data Breaches - Quarterly Statistics Report: January 2018–March 2018., 2018.Google Scholar
  22. 22.
    VERIS Community Database (VCDB) Project. The VERIS Community Database (VCDB)., 2018.
  23. 23.
    Verizon. Protected health information data breach report, 2015.Google Scholar
  24. 24.
    Federal Bureau of Investigation (FBI). Table 16 property stolen and recovered. Accessed 22 April 2018.
  25. 25.
    Palmer, G., A road map for digital forensic research. In: First Digital Forensic Research Workshop, Utica, pp 27–30, 2001.Google Scholar
  26. 26.
    Baryamureeba, V., and Tushabe F., The enhanced digital investigation process model. In, 2004.Google Scholar
  27. 27.
    Carrier, B., Spafford EH An event-based digital forensic investigation framework. In: Digital forensic research workshop, 2004.Google Scholar
  28. 28.
    Cohen, F., Toward a Science of Digital Forensic Evidence Examination. In Advances in Digital Forensics VI. Springer Berlin Heidelberg, pp 17–35, 2010.Google Scholar
  29. 29.
    Kohn, M. D., Eloff, M. M., and Eloff, J. H. P., Integrated digital forensic process model. Comput Secur 38:103–115, 2013. Scholar
  30. 30.
    Tan, J., Forensic readiness. Cambridge: @ Stake, 2001, 1–23.Google Scholar
  31. 31.
    Sachowski, J., Implementing Digital Forensic Readiness: From Reactive to Proactive Process. 1st edn. Syngress, 2016.Google Scholar
  32. 32.
    Hunt, R., and Zeadally, S., Network Forensics: An Analysis of Techniques, Tools, and Trends. Computer 45(12):36–43, 2012. Scholar
  33. 33.
    Khan, S., Gani, A., Wahab, A. W. A., Bagiwa, M. A., Shiraz, M., Khan, S. U., Buyya, R., and Zomaya, A. Y., Cloud log forensics: Foundations, state of the art, and future directions. ACM Computing Surveys (CSUR) 49(1):7, 2016.CrossRefGoogle Scholar
  34. 34.
    Jiang, J., Chen, J., Choo, K.-K. R., Liu, C., Liu, K., Yu, M., A Visualization Scheme for Network Forensics Based on Attribute Oriented Induction Based Frequent Item Mining and Hyper Graph. In Digital Forensics and Cyber Crime. Cham: Springer International Publishing, pp 130–143, 2018.Google Scholar
  35. 35.
    MacRae, J., and Franqueira V. N., On Locky Ransomware, Al Capone and Brexit. In: International Conference on Digital Forensics and Cyber Crime, Springer, pp 33–45, 2017.Google Scholar
  36. 36.
    BitCluster, BitCluster. Accessed 28 April 2018.
  37. 37.
    Elliptic, Elliptic. Accessed 28 April 2018.
  38. 38.
    Vargas, J., Bahnsen, A. C., and Villegas, S., Ingevaldson D Knowing your enemies: Leveraging data analysis to expose phishing patterns against a major US financial institution. In: Electronic Crime Research (eCrime), 2016 APWG Symposium on. IEEE, pp 1–10, 2016.Google Scholar
  39. 39.
    Hamid, I. R. A., Samsudin, N. A., Mustapha, A., and Arbaiy, N., Dynamic Trackback Strategy for Email-Born Phishing Using Maximum Dependency Algorithm (MDA). In Recent Advances on Soft Computing and Data Mining. Cham: Springer International Publishing, pp 263–273, 2017.Google Scholar
  40. 40.
    Gupta, B. B., Tewari, A., Jain, A. K., and Agrawal, D. P., Fighting against phishing attacks: state of the art and future challenges. Neural Computing and Applications 28(12):3629–3654, 2017. Scholar
  41. 41.
    Jayabalan, M., and Daniel T., Continuous and Transparent Access Control Framework for Electronic Health Records: A Preliminary Study. In: International Conference on Information Technology on Information Technology, Information Systems, and Electrical Engineering (ICITISEE 2017), 2017.Google Scholar
  42. 42.
    Kose, I., Gokturk, M., and Kilic, K., An interactive machine-learning-based electronic fraud and abuse detection system in healthcare insurance. Applied Soft Computing 36:283–299, 2015.CrossRefGoogle Scholar
  43. 43.
    King, J., Stallings, J., Riaz, M., and Williams, L., To log, or not to log: using heuristics to identify mandatory log events – a controlled experiment. Empirical Software Engineering 22(5):2684–2717, 2017. Scholar
  44. 44.
    Protenus, Getting Schooled on Patient Privacy Analytics. Accessed 3 May 2018.
  45. 45.
  46. 46.
    Zawoad, S., Dutta, A. K., and Hasan R., SecLaaS: secure logging-as-a-service for cloud forensics. In: Proceedings of the 8th ACM SIGSAC symposium on Information, computer and communications security. ACM, pp 219–230, 2013.Google Scholar
  47. 47.
    Nanda, S., Hansen, R. A., Forensics as a Service: Three-tier Architecture for Cloud based Forensic Analysis. In: Parallel and Distributed Computing (ISPDC), 2016 15th International Symposium on, 2016. IEEE, pp 178–183Google Scholar
  48. 48.
    Zawoad, S., and Hasan, R., Faiot: Towards building a forensics aware eco system for the internet of things. In: Services Computing (SCC), 2015 IEEE International Conference on. IEEE, pp 279–284, 2015.Google Scholar
  49. 49.
    Raju, B. K., Moharil, B., Geethakumari G FaaSeC: Enabling Forensics-as-a-Service for Cloud Computing Systems. In: 2016 IEEE/ACM 9th International Conference on Utility and Cloud Computing (UCC). pp 220–227, 2016.Google Scholar
  50. 50.
    Yang, H., and Garibaldi, J. M., Automatic detection of protected health information from clinic narratives. Journal of Biomedical Informatics 58:S30–S38, 2015. Scholar
  51. 51.
    Frühwirt, P., Kieseberg, P., Schrittwieser, S., Huber, M., and Weippl, E., InnoDB database forensics: Enhanced reconstruction of data manipulation queries from redo logs. Information Security Technical Report 17(4):227–238, 2013.CrossRefGoogle Scholar

Copyright information

© Springer Science+Business Media, LLC, part of Springer Nature 2018

Authors and Affiliations

  1. 1.Edith Cowan UniversityPerthAustralia
  2. 2.University of KentuckyLexingtonUSA
  3. 3.Commonweath Scientific and Industrial Research Organisation (CSIRO)Data61MelbourneAustralia

Personalised recommendations