I recently read an excellent piece on BenefitsPRO about cyberattacks in health care. The article noted that the value of a stolen health identity is 10 times what a credit card is worth. This number reflects the cyber thief’s calculation: How much can I steal multiplied by what are the odds of getting away with it. The answer to this equation makes a health identity that much more valuable in the black market.

Part of the reason for the reduced value of a credit card is the lower odds of getting away with the crime, and the amount that can be stolen has been significantly reduced by credit bureau reporting of transactions in real-time. We’ve all had one of those calls (“Mr. Leston? This is your bank. Your card is being used to buy tires in Istanbul, so we wanted to make sure you had your card in your possession…”) [a real case]

Stolen credit cards aren’t worth what they used to be. We need to make health identities less valuable to cyber thieves, as the financial industry has done with credit identity. Health plan and benefit executives need to start with the assumption that health and benefits information has already been compromised; unfortunately, the odds are that it has. It is already widely available; the reasons are below. The priorities should not only include limiting access to the benefits information, but preventing inappropriate use in daily interaction with the health care system.